QuestionQ300
Designing for security and complianceA large multinational company is migrating to Google Cloud. It has distinct business units: Finance, Marketing, and Research and Development (R&D). The central security team has established the following governance requirements for each unit:
- Finance: Must be limited to deploying resources only in the specific compliant regions
us-central1andeurope-west2. Access to its projects must be strictly controlled by a dedicatedfinance-adminsgroup. - Marketing: Requires separate production and development environments, with different teams responsible for managing each environment.
- R&D: Needs maximum flexibility to test new services, but must be fully isolated so it cannot affect production systems.
- Global Auditing: A central compliance team needs read-only access to view every resource across the entire company for auditing.
You must design a resource hierarchy that enforces these security policies at scale, follows the Google Cloud Well-Architected Framework, and provides each business unit with the appropriate level of autonomy. What should you do?
- A Create a folder for each department under the root Organization node. Apply the resource location Organization Policy on the Finance folder. Within the Marketing folder, create separate projects for mktg-prod and mktg-dev. Grant the compliance team the roles/viewer role at the Organization level.
- B Place all projects directly under the Organization node. Use network tags and service accounts to enforce security boundaries between the different department workloads. Apply the resource location Organization Policy on the Finance project.
- C Create separate Google Cloud Organizations for each department (Finance, Marketing, and R&D). Grant the compliance team the roles/viewer role for each organization.
- D Create a single project for each department. Apply the resource location policy directly to the Finance project. Grant the compliance team the roles/browser role on each project individually.
Community Discussion