Cloud Digital Leader How Google Cloud Resources Are Managed Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Resource

  Why it's wrong here

  Resource-level IAM policies attach to a single resource, such as a Compute Engine instance or a Cloud Storage bucket. They apply only to that exact resource and cannot aggregate or organize resources across multiple departments or projects. Additionally, many resource types do not support standalone IAM policies, and the parent project's restrictions limit what resource-level policies can be assigned. Thus, relying on resource-level policies would force you to configure each resource in isolation, which is not an effective way to organize resources company-wide.

• ✗

  Folder

  Why it's wrong here

  Folder-level IAM policies apply only to the projects that are directly contained within that folder, plus any of that folder's subfolders. Folders are placed below the organization node and are intended for grouping projects that share the same administrative or billing requirements, not for representing an entire organization. If you set a policy on a folder, it does not affect projects outside that folder, so you would need to create and maintain multiple folder hierarchies to cover every department. This makes a folder insufficient as a single global point of organization for all of an organization's resources.

• ✗

  Project

  Why it's wrong here

  Project-level IAM policies apply exclusively to resources that reside inside that specific project, or to the project itself when setting roles like Viewer or Editor. A project cannot contain other projects, so it cannot group your organization's resources that exist in separate projects. Additionally, using a single project to hold resources for multiple departments would collapse all isolation boundaries and make it impossible to apply department-specific policies or audit trails without cumbersome resource-level exceptions. Because the project is only one level of the hierarchy, it cannot serve as the root for an organization-wide resource management strategy.

• ✓

  Organization node

  Why this is correct

  The organization node is the root of the Google Cloud resource hierarchy, encompassing all folders and projects under it. IAM policies and organizational policies set at the organization node are inherited by every child folder and project, which means you can enforce uniform access controls, billing, and audit logging across multiple departments from a single central point. This allows administrators to model the entire enterprise as a single tree and apply department-specific organization policies by creating folders underneath the node, while still having a global fallback policy. Therefore, the organization node is the correct place to define high-level, cross-departmental resource organization and governance.

Go deeper

Related to this question