Cloud Digital Leader How Google Cloud Resources Are Managed Practice Question
A company needs to organize their GCP resources into a hierarchy that reflects their departments: Engineering, Marketing, and Finance. Each department has multiple projects. They also want to apply common policies to all departments except Finance, which has special compliance requirements. Which TWO steps should they take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply organization policies at the organization node and override them for the Finance folder using tags.
Create folders for each department, and apply policies to the organization node with exceptions via tags.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use labels to differentiate departments instead of folders.
Why it's wrong here
Labels are key-value metadata that support cost tracking, filtering, and resource grouping, but they do not form a hierarchical structure. The GCP resource hierarchy uses folders to provide a node for grouping projects, enabling inheritance of IAM and organization policies; labels cannot inherit or enforce policies. Relying solely on labels for departmental separation means you lose the ability to apply organization-wide constraints to an entire department, making governance fragmented.
- ✓
Apply organization policies at the organization node and override them for the Finance folder using tags.
Why this is correct
Organization policies set at the organization node are inherited by all descendants, establishing a consistent security and compliance baseline. However, using tags as condition keys in policy constraints allows you to create exceptions, such as permitting a specific resource setting only for the Finance folder. This pattern preserves centralized control while accommodating department-specific needs, aligning with the recommended practice of least privilege and scoped flexibility.
- ✗
Apply separate IAM policies for each project within a folder.
Why it's wrong here
While each project can have its own IAM policy, duplicating common department-level roles across every project is inefficient and prone to inconsistency. Folder-level IAM bindings are inherited by all projects in the folder, so granting roles at the folder level ensures uniform access and simplifies management. Separate IAM policies should only be used for project-specific permissions that differ from the folder's common roles, not as a substitute for folder-level governance.
- ✗
Create a project for each department and place resources in it.
Why it's wrong here
Projects are containers for resources, but creating one project per department without folders fails to provide a hierarchical grouping above the project level. Since projects do not support nesting, you cannot apply policies to a group of projects without folders; you would still need folders to aggregate them. Moreover, placing all departmental resources into a single project would violate isolation best practices and would not allow granular policy inheritance across the department.
- ✓
Create a folder for each department.
Why this is correct
Folders are the natural node in the GCP resource hierarchy for grouping projects by department, enabling you to attach IAM and organization policies at the folder level. These policies are inherited by all projects and resources within the folder, giving you a centralized way to manage access and constraints for an entire business unit. Creating per-department folders also allows you to isolate resources and apply differing policies without maintaining a flat project list under the organization root.
Go deeper
Related to this question
Learn chapter
Data Sovereignty and Compliance on Google Cloud
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.