GCP Professional Cloud Security Engineer Practice Question

ExampleCorp has six product lines that spin up dozens of GCP projects every quarter. Compliance must enforce VM external-IP restrictions only for production workloads. Product-line administrators must self-provision new projects for their line without obtaining organization-level roles. Project names must follow a standard pattern and inherit the required constraints automatically. You want the central security team to stay out of the provisioning path while retaining policy control. Which approach best meets these requirements?

Establish two Google Cloud organizations-one for production and one for non-production-and grant product-line admin groups the Organization Administrator role in each so they can create projects directly.
Have the central security team create every project manually, move it into the right folder, apply the external-IP constraint, and then assign admin roles to the product-line group.
Create separate production and non-production folders, add a sub-folder per product line, grant each product-line admin group roles/resourcemanager.folderAdmin and roles/resourcemanager.projectCreator on its sub-folder, apply the VM external-IP Organization Policy constraint to the production folder, and use an automated pipeline that creates correctly named projects inside the appropriate sub-folder.
Grant each product-line admin group the Project Creator role at the organization level and apply the external-IP constraint to projects after creation by using tag-based policies.

Report Issue

Answer Description

Creating separate production and non-production folders lets you attach Organization Policy constraints-such as disabling external VM IPs-once at the production folder so that every project created beneath it inherits the rule. Granting each product-line admin group the Folder Admin and Project Creator roles on only their own sub-folder lets them create and manage projects without any organization-wide privileges. An automation pipeline that calls the Cloud Resource Manager API or gcloud projects create enforces naming conventions and places the project directly in the correct folder, eliminating manual effort by the central security team. The other approaches either over-privilege administrators, require manual intervention, or fragment the organization into multiple org nodes, all of which increase operational overhead or weaken governance.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.