Cloud Digital Leader How Google Cloud Resources Are Managed Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a separate billing account for each project

  Why it's wrong here

  Creating a separate billing account for each project is not only an administrative burden but also fails to enforce any location constraint, since resources can still be provisioned in any region as long as the project's quotas and policies allow it. Billing accounts control cost and payment, not the geographic placement of resources. Therefore this approach neither satisfies the location requirement nor simplifies governance.

• ✗

  Use IAM deny policies at the organization node to block resource creation outside us-central1

  Why it's wrong here

  IAM deny policies are used to explicitly deny principals from performing specific actions on specific resources; they cannot directly block the creation of resources in a particular cloud region. The gcp.resourceLocations organization policy is the constraint that defines allowed locations, evaluated during resource creation, not at authorization time. Consequently, deny policies are the wrong mechanism for this geographic restriction.

• ✓

  Apply the `gcp.resourceLocations` organization policy constraint at the organization node

  Why this is correct

  The gcp.resourceLocations constraint is an organization policy that restricts where new resources can be created; setting it at the organization node applies it to all projects under the hierarchy. This constraint evaluates the location of each resource at creation time, blocking any attempt to create resources outside the allowed list (e.g., us-central1). This is the recommended way to enforce a single global location rule across the entire organization.

• ✗

  Create a folder and apply an organization policy constraint to restrict locations at the folder level

  Why it's wrong here

  Applying a location constraint at the folder level would restrict resource creation only for projects within that specific folder, but the requirement is to enforce the restriction across *all* projects in the organisation, which demands an organisation-level policy constraint. This option is tempting because folder-level policies are the correct mechanism when the goal is to apply different location restrictions to distinct business units or departments, rather than a single, uniform rule for the entire hierarchy.

• ✓

  Grant the Finance team the Billing Account Administrator role on the billing account

  Why this is correct

  Assigning the Billing Account Administrator role to the Finance team on the billing account grants them the ability to manage billing account settings, link/unlink projects, and control cost management for all projects using that billing account. This role does not affect resource location policies, but it satisfies the separate requirement that only the Finance team has billing management oversight. The role can be granted at the billing account level to cover all linked projects.

Go deeper

Related to this question