Cloud Digital Leader How Google Cloud Resources Are Managed Practice Question
A startup wants to organize its Google Cloud resources by separating development, staging, and production environments. They also need to apply common IAM policies across all projects in each environment. Which resource hierarchy component should they use to group projects per environment?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Folders
Folders allow grouping of projects and are used to reflect organizational structure or environment separation. IAM policies applied at the folder level are inherited by all projects within that folder.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Organization node
Why it's wrong here
The organization node is the root of the entire Google Cloud resource hierarchy and is automatically provisioned for every Cloud account. It represents the whole company or enterprise domain, not a specific environment, and there can be only one per organization. Using it to separate dev from prod would force you into multiple organizations, which fragments IAM and makes centralized billing and security visibility far more complex. Therefore, it is not a suitable construct for per-environment grouping.
- ✗
Tags
Why it's wrong here
Tags are key-value metadata pairs that you can attach to projects or other resources to conditionally manage IAM policies and enforce network firewall rules. They enable granular, condition-based access decisions (for example, allowing a principal only if a resource has a specific tag), but they do not create a grouping boundary in the resource hierarchy. Tags cannot act as containers, so they cannot provide the inherited IAM or project grouping that an environment isolation scheme requires.
- ✓
Folders
Why this is correct
Folders are nodes in the resource hierarchy that sit between the organization node and projects, and they can contain both projects and other folders, enabling a flexible, nested structure. You can create separate folders for dev, staging, and production, and IAM policies assigned to a folder are inherited by every project inside it, which centralizes access control. This is the correct choice because it gives you a hierarchical grouping with policy inheritance, exactly what an environment-based organization needs.
- ✗
Labels
Why it's wrong here
Labels are metadata key-value pairs attached to a resource to support cost accounting, querying, and resource filtering across the platform. They are completely flat and have no bearing on the resource hierarchy, so they do not influence IAM policy inheritance or project permissions. If you attempted to group projects by labels, you would still need to set IAM policies per project manually, and labels would not enforce any boundary, making them unsuitable for environment grouping.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Google Cloud
Google Cloud is a suite of cloud computing services offered by Google that provides infrastructure, platform, and software solutions over the internet.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.