Google PCA Design and plan a cloud solution architecture Practice Question

A multinational enterprise is designing its Google Cloud resource hierarchy. They want to enforce centrally managed policies, delegate administration to regional business units, and isolate billing. Which two design choices should the architects make? (Choose two.)

⚠ Common exam trap

The trap here is assuming labels or a shared network can substitute for folders and separate billing accounts when enforcing governance and cost isolation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create folders per business unit under the organization node and apply organization policies at the appropriate folder level.

Folders under the organization node enable policy inheritance and delegated administration, letting central teams set guardrails while business units own their projects. Separate Cloud Billing accounts per business unit isolate costs and budgets. Labels, over-broad organization roles, and networking alone do not deliver the required policy control and billing separation.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Create folders per business unit under the organization node and apply organization policies at the appropriate folder level.
Why this is correct
Folders let you group projects by business unit and apply organization policies and IAM inheritance at the folder level, so central teams enforce guardrails while regional units manage their own projects beneath. This cleanly supports delegated administration and centralized policy control, matching the stated governance goals.
✗
Create a single project for all business units and use labels to separate their resources.
Why it's wrong here
Labels are metadata used for filtering, billing reports, and queries, but they do not provide policy inheritance, IAM boundaries, or administrative delegation. Putting every business unit in one project removes isolation between teams and makes it impossible to apply distinct organization policies per unit, undermining the governance design.
✗
Use a single Shared VPC in the organization host project for all business units without folders.
Why it's wrong here
A Shared VPC centralizes networking but does not by itself provide policy inheritance, administrative delegation, or billing isolation. Without folders, business units cannot receive distinct organization policies, and a single shared network increases blast radius. Networking alone cannot satisfy the governance and billing separation requirements.
✓
Assign each business unit its own Cloud Billing account and link their projects to that account.
Why this is correct
Separate Cloud Billing accounts per business unit give each unit independent billing, budgets, and cost visibility, which directly satisfies the isolation-of-billing requirement. Projects link to the appropriate billing account, so charges flow to the correct unit while the shared resource hierarchy still enforces central policies.
✗
Grant every business unit administrator the Organization Administrator role so they can manage their own projects.
Why it's wrong here
Organization Administrator is a highly privileged role that grants control over the entire organization, including all folders, policies, and billing. Granting it to each business unit administrator violates least privilege and destroys the central governance boundary, so it is the opposite of the delegated, isolated administration the enterprise wants.

Go deeper

Google PCA Design and plan a cloud solution architecture Practice Question

Why each option matters

Option-by-option breakdown

Related to this question