A financial services organization is architecting its Google Cloud environment to support automated data pipelines and analytics workloads. The company has distinct compliance requirements across its environments and needs to design a resource hierarchy that enforces strict data governance. The architecture must satisfy the following requirements: Centralize strict security baselines, resource location constraints, and access policies consistently across all production workloads while permitting developers to iterate quickly with fewer restrictions in development. Enable centralized audit log aggregation across all child resources without configuring individual sinks in every data project. Prevent unauthorized egress and cross-boundary data exfiltration from sensitive production analytics data stores (such as BigQuery and Cloud Storage). How should the organization structure its resource hierarchy and security boundaries?

Organize projects into top-level environment folders (such as Development and Production); enforce Organization Policy constraints and aggregated Cloud Logging sinks at the folder level; and place production data projects inside a VPC Service Controls security perimeter.: ### What the solution is This architecture establishes a **multi-tiered resource hierarchy** structured around application environments (**Development**, **Production**) directly under the **Organization** node. It leverages folder-level inheritance to enforce **Organization Policy** constraints and **aggregated Cloud Logging sinks**, while isolating production data services within a **VPC Service Controls (VPC SC)** perimeter. ### How it meets the requirements - **Consistent security baselines & environment isolation:** Structuring the top-level hierarchy into environment-based folders allows the security team to apply baseline **Organization Policy constraints** and restrictive **IAM role bindings** at the `Production` folder level. These policies are inherited across all child projects hosting production workloads, while the `Development` folder can maintain more permissive configurations. - **Centralized audit log aggregation:** Defining an **aggregated Cloud Logging sink** at the parent folder or organization level automatically routes all audit logs from all current and future child projects to a central security sink without requiring project-by-project management. - **Preventing data exfiltration:** Enclosing production data processing and storage services (such as **BigQuery** and **Cloud Storage**) within a **VPC Service Controls perimeter** prevents unauthorized access from untrusted networks and prevents data exfiltration across service boundaries. ### Key advantages - **Declarative Governance:** Child projects automatically inherit guardrails and policy constraints from parent folders, reducing human configuration error. - **Scalable Operations:** Centralized log routing simplifies SIEM ingestion and long-term compliance audits. - **Egress Protection:** VPC SC creates a cryptographic and network boundary around Google Cloud APIs that IAM permissions alone cannot enforce. ### Why this is optimal Designing the top-level folders by application environment aligns directly with centralized security governance needs where production requirements strictly diverge from non-production requirements. Combining folder inheritance with VPC Service Controls delivers defense-in-depth against both internal misconfigurations and external exfiltration.

Design Resource Hierarchy Governance Security Boundaries | professional-cloud-data-engineer

Design Resource Hierarchy Governance Security Boundaries

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial services organization is architecting its Google Cloud environment to support automated data pipelines and analytics workloads. The company has distinct compliance requirements across its environments and needs to design a resource hierarchy that enforces strict data governance.

The architecture must satisfy the following requirements:

Centralize strict security baselines, resource location constraints, and access policies consistently across all production workloads while permitting developers to iterate quickly with fewer restrictions in development.
Enable centralized audit log aggregation across all child resources without configuring individual sinks in every data project.
Prevent unauthorized egress and cross-boundary data exfiltration from sensitive production analytics data stores (such as BigQuery and Cloud Storage).

How should the organization structure its resource hierarchy and security boundaries?

Create separate standalone Google Cloud organizations for development and production; configure folder-level aggregated sinks in each; and attach standard Cloud Armor security policies to Cloud Storage buckets.

Group projects by individual business unit folders; manage individual Cloud Logging sinks inside each data project; and apply IAM Deny policies on BigQuery datasets to restrict network egress.

Place all development and production projects directly under the Organization node; configure ConsumerPolicy resources via Service Usage on each project; and use Hierarchical Firewall Policies to restrict BigQuery API calls.

Organize projects into top-level environment folders (such as Development and Production); enforce Organization Policy constraints and aggregated Cloud Logging sinks at the folder level; and place production data projects inside a VPC Service Controls security perimeter.

Professional Cloud Data Engineer

Design Resource Hierarchy Governance Security Boundaries

Related questions