Google ACE Practice Question: A company organizes its GCP projects by business…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Apply labels to each project to identify the business unit

  Why it's wrong here

  Labels are key-value metadata attached to projects (or other resources) for cost accounting, billing attribution, and filtering in monitoring or APIs. They do not create any hierarchical scope: IAM policies cannot be assigned to a label value, and labels provide no inheritance mechanism to apply uniform permissions across multiple projects. While IAM conditions can reference labels on individual resources, that is resource-level scoping inside a project, not a way to bind a single policy to an entire business unit's project collection.

• ✗

  Apply resource tags to each project for policy enforcement

  Why it's wrong here

  Resource tags in GCP are metadata key-value pairs attached to resources for filtering and cost accounting, not for enforcing IAM policies across a group of projects. The stem requires shared IAM policies applied uniformly to all projects in each business unit, which tags cannot deliver because tags do not aggregate projects into a policy-binding scope. This option is tempting because tags are commonly used for organising resources and triggering conditional access in other contexts, such as applying IAM conditions based on tag values within a single project, but they lack the hierarchical project-grouping mechanism that a folder or organisation node provides.

• ✓

  Create GCP Folders for each business unit and add the relevant projects

  Why this is correct

  Folders are dedicated nodes in the GCP resource hierarchy (Organization → Folders → Projects) designed for grouping projects under a common administrative boundary. IAM policies, Organization Policies, and other settings bound to a Folder are inherited by every project in that subtree, enabling uniform access control and regulatory constraints for a business unit. Using Folders also supports delegated administration, such as granting a Project Creator role scoped to that Folder, and is the only mechanism that provides genuine hierarchical policy inheritance across multiple projects.

• ✗

  Create a Shared VPC host project for each business unit

  Why it's wrong here

  Shared VPC is a networking feature that allows a host project to share its VPC subnets with service projects, solving cross-project connectivity and centralizing network administration. However, it does not create a logical group for applying IAM or Organization Policies across projects; each project remains an independent IAM resource. Even with Shared VPC, you must still manage IAM roles separately per project, and host-project permissions only cover shared network resources, not the business-unit-wide policy uniformness described in the scenario.

Go deeper

Related to this question