An enterprise organization with multiple distinct business units is designing its Google Cloud landing zone. The organization must meet the following requirements: Provide strict administrative autonomy and policy inheritance separation across business units and lifecycle environments (development, staging, and production) Enforce complete network-level isolation between environments while centrally managing network security Ensure accurate cost tracking and billing attribution per business unit and environment Allow application teams to manage their own computing workloads without granting them permission to alter shared networking infrastructure Which resource hierarchy and networking design strategy should you implement?

Organize the resource hierarchy with top-level folders for each business unit containing subfolders for each lifecycle environment, place workload projects within these subfolders, and deploy a dedicated Shared VPC network for each environment.: ### What this resource hierarchy and networking strategy is This strategy uses **Google Cloud Resource Manager folders and projects** in a hierarchical layout to mirror business units and environments, combined with **Shared VPC** networks dedicated to each environment (such as development, staging, and production). ### How it meets the requirements - **Administrative autonomy & policy inheritance**: Creating top-level folders per business unit with nested environment subfolders allows **Identity and Access Management (IAM)** roles and **Organization Policies** to be applied and inherited predictably at the appropriate scope. - **Network-level separation**: Deploying a dedicated Shared VPC for each lifecycle environment provides complete network isolation, preventing cross-environment traffic and limiting blast radius. - **Billing and cost attribution**: Distributing distinct workloads into separate projects within specific folder branches allows seamless cost allocation and granular billing exports labeled by project and folder. - **Separation of duties**: Shared VPC separates network administration (hosted in a central network project) from workload administration (in service projects), enabling application teams to deploy resources into provisioned subnets without having permissions to modify firewall rules or routing. ### Key advantages and capabilities - **Granular IAM scoping**: Permissions can be granted at the folder or project level to provide autonomy without broad privileges. - **Consistent policy enforcement**: Organizational policies (such as restricting external IP addresses) can be enforced across entire folders. - **Centralized network governance**: Network administrators control subnets, routes, and firewalls while service project teams manage compute instances. - **Simplified auditing**: Resource grouping makes compliance monitoring and billing reports straightforward. ### Why this is optimal Aligning **folders for business units and environments** with **dedicated Shared VPC networks per environment** satisfies enterprise governance, administrative boundary separation, and network security simultaneously without creating unmanageable architectural overhead.

StudyCerts

Resource Hierarchy Isolation Folders Projects Shared Vpc | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Resource Hierarchy Isolation Folders Projects Shared Vpc

Section: Resource hierarchy (organizations, folders, and projects)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization with multiple distinct business units is designing its Google Cloud landing zone. The organization must meet the following requirements:

Provide strict administrative autonomy and policy inheritance separation across business units and lifecycle environments (development, staging, and production)
Enforce complete network-level isolation between environments while centrally managing network security
Ensure accurate cost tracking and billing attribution per business unit and environment
Allow application teams to manage their own computing workloads without granting them permission to alter shared networking infrastructure

Which resource hierarchy and networking design strategy should you implement?

Deploy all business units into a single flat organization-level Shared VPC host project and assign Compute Network Admin roles to business unit leads in that host project.

Create an App Hub host project for each business unit to discover resources, and assign Cloud Armor security policies at the project level to isolate development from production traffic.

Create a single project per business unit containing multiple VPC networks for each environment, and use VPC Network Peering to connect all environment VPCs back to an on-premises transit hub.

Organize the resource hierarchy with top-level folders for each business unit containing subfolders for each lifecycle environment, place workload projects within these subfolders, and deploy a dedicated Shared VPC network for each environment.

Professional Cloud Architect

Resource Hierarchy Isolation Folders Projects Shared Vpc

Related questions