GCP Professional Cloud Architect Practice Question

Your organization has grown to three geographically distinct engineering divisions (EMEA, APAC, Americas). Dozens of projects currently hang directly under the Organization node. Each division must be able to create and manage only its own projects, while the central security team needs to apply a "no-external-ip" Organization Policy constraint exclusively to development workloads without affecting production. Which approach best satisfies both requirements with the least administrative overhead?

Move projects into separate Google Workspace organizational units for each region and apply group-based IAM and security settings at the OU level.
Create a folder for each region under the Organization and a Development and Production sub-folder inside each. Delegate Project Creator and IAM administration to division admins on their regional folder and apply the "no-external-ip" Organization Policy to the Development folders.
Create a dedicated shared VPC network per region and use subnet-level IAM bindings plus firewall rules to prevent external IPs in development subnets.
Rely on project labels that indicate region and environment, then use Cloud Asset Inventory and automation to detect and remediate policy violations.

Report Issue

Answer Description

Folders provide an intermediate node in the resource hierarchy that inherits both IAM and Organization Policy settings. By creating a folder for each engineering division and nested folders for environment types (for example, Development and Production), you can:

Grant each division's admin group the Project Creator role on its regional folder, limiting their scope to that folder's descendants.
Attach the "compute.vmExternalIpAccess" constraint only to the Development sub-folders so it propagates to dev projects but not to Production. Labels alone do not enforce IAM or Organization Policy. VPC design and shared VPC host projects do not control project-level IAM or policy inheritance. Google Workspace OUs do not map to Google Cloud's resource hierarchy for access control. Therefore, introducing a hierarchical folder structure is the most effective and least complex solution.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.