Professional Cloud ArchitectDemo

By Google · Question Mode

QuestionQ301

Designing for security and compliance

You manage your company’s Google Cloud environment. Multiple departments require access to their own projects, and all members within a department will have the same project responsibilities. You want to organize the Google Cloud environment to minimize maintenance and maximize visibility of IAM permissions as each department’s projects are created and retired. You want to follow Google-recommended practices. What should you do?

  • A Grant all department members the required IAM permissions for their respective projects.
  • B Create a Google Group per department and add all department members to their respective groups. Create a folder per department and grant the respective group the required IAM permissions at the folder level. Add the projects under the respective folders.
  • C Create a folder per department and grant the respective members of the department the required IAM permissions at the folder level. Structure all projects for each department under the respective folders.
  • D Create a Google Group per department and add all department members to their respective groups. Grant each group the required IAM permissions for their respective projects.
Explanation

Google Cloud recommends using groups when multiple principals need the same access, instead of assigning roles to individual users. Roles granted at a folder are inherited by projects under that folder; therefore, a department group with IAM roles assigned at its department folder receives consistent access across that department’s projects while membership and permissions are managed centrally.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!