Cloud Digital Leader Scaling with Google Cloud operations Practice Question
A company uses Google Cloud across 5 teams, 20 projects, and 3 regions. They want to enforce a standard that all resources include specific labels (e.g., `team`, `environment`, `cost-center`) for cost attribution and governance. What is the most scalable way to enforce this labeling standard?
⚠ Common exam trap
Many candidates choose a manual or human-dependent option (like A or D) because they underestimate the scale and automation requirements of a multi-team, multi-project environment, failing to recognize that only IaC with automated auditing provides scalable enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforce labeling through IaC templates with required label variables in CI/CD pipelines, and use Cloud Asset Inventory to audit compliance.
It combines Infrastructure as Code (IaC) templates with required label variables in CI/CD pipelines to enforce labeling at resource creation time, and uses Cloud Asset Inventory to audit and detect non-compliant resources. This approach is scalable across 5 teams, 20 projects, and 3 regions because it automates enforcement and provides continuous compliance monitoring without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Send monthly reminders to all teams via email to add labels to their resources.
Why it's wrong here
A monthly email reminder is a purely informational nudge with no technical enforcement, so it cannot guarantee that labels are applied consistently or at all. Because teams manage different workloads across 20 projects, manual compliance tasks are deprioritized and there is no record of whether each team actually updated its resources. Reminders also lack a standard label taxonomy, allowing each team to invent its own keys and values, and produce no audit trail to prove compliance to finance or operations. Automated policy checks that run on every deployment are the only way to make labeling behavior deterministic and enforceable.
- ✓
Enforce labeling through IaC templates with required label variables in CI/CD pipelines, and use Cloud Asset Inventory to audit compliance.
Why this is correct
Enforcing labels through Infrastructure as Code (e.g., Terraform or Deployment Manager) makes labels a mandatory input in your templates, so any resource that does not include required label keys fails the plan/apply step. CI/CD pipelines can run additional policy checks (such as `terraform plan -var` validation or a custom script) to detect missing labels before deployment, preventing unlabeled resources from ever being created. Cloud Asset Inventory then provides a continuously updated searchable view of all assets and their labels, allowing you to audit compliance across all 20 projects and quickly identify any drift introduced by out-of-band changes. This combination of prevention at creation and detection afterward is the only fully automated and scalable approach.
- ✗
Manually add labels to all existing and new resources through the Cloud Console.
Why it's wrong here
Manually labeling resources in Cloud Console is a per-resource, GUI-driven process that does not scale to 20 projects with continuous deployment. Labels are metadata on each resource and are not inherited from project, folder, or organization, so every compute instance, storage bucket, and service must be individually edited. This makes it easy to miss newly created resources, create inconsistent key/value pairs (e.g., 'env:prod' vs 'Env:Prod'), and leaves no automated verification that all resources are compliant. Even a single project with dev, staging, and prod environments quickly becomes unmanageable.
- ✗
Grant only project owners permission to create resources, and rely on them to enforce labeling.
Why it's wrong here
Designating project owners as the only creators of GCP resources turns labeling into a manual approval process, creating a bottleneck that slows development and blocks self-service IaC workflows. Project owners cannot reliably apply consistent label keys and values across hundreds of ephemeral resources, and nothing enforces compliance if they skip a label. It also grants unnecessarily broad create permissions to a few individuals, contradicting least privilege, and does not leverage native GCP policy mechanisms or infrastructure-as-code validation. The result is incomplete, inconsistent labeling that is not auditable at scale.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Labels
Labels are descriptive text or tags attached to IT resources to organize, identify, and manage them based on attributes like purpose, environment, or owner.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This GCDL question is part of Courseiva's 829-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.