Cloud Digital Leader How Google Cloud Resources Are Managed Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use folders under the organization node, one per department, and place projects inside them

  Why this is correct

  Folders under the organization node establish a resource hierarchy where each department's folder can have IAM policies and billing defaults applied, cascading to all projects within. This separates access control by making the department folder an administrative boundary, and also allows aggregated billing per folder by linking a dedicated billing account to that folder, which individual projects inherit.

• ✗

  Place all resources in a single project and use Cloud Identity groups for access

  Why it's wrong here

  Placing all resources in a single project collapses every department into one uncontrolled namespace. Cloud Identity groups only manage who can access what within that single project; they cannot create separate administrative boundaries or independently track cost per department. Project-level IAM applies uniformly to all resources, so any access grant gives access across all departments, and billing is still aggregated without per-department attribution.

• ✗

  Create one project per department and use labels to separate them

  Why it's wrong here

  Assigning one project per department and using labels to separate them treats labels as a substitute for hierarchy, but labels are simply key-value metadata used for cost categorization and search, not for IAM policy inheritance. Without folders, there is no parent container to apply common policies or delegate administration, so each project must be managed individually, and moving resources between projects does not preserve relationships. This also fails to separate billing for each department because labels only report cost information, not enforce isolation.

• ✗

  Create separate billing accounts per department and link projects directly

  Why it's wrong here

  Creating a dedicated billing account for each department only decouples the invoice, not the enforcement of access. Billing accounts are financial entities that can be linked to any project, regardless of whether they exist in the same folder, and they do not contain IAM policies for project resources. Projects under separate billing accounts still share the same organization hierarchy, so without folders you cannot apply department-specific IAM to groups of projects; billing boundaries do not translate into administrative ones.

Go deeper

Related to this question