An enterprise is establishing a multi-tier Google Cloud resource hierarchy to support several business units with strict regulatory requirements across Development, Staging, and Production environments. The security architecture must satisfy the following constraints: Enforce distinct environment-specific organization policies (such as location restrictions and external IP constraints) and prevent accidental inheritance of permissive non-production settings into production. Implement strict separation of duties between central network administrators, security operators, and application development teams. Centralize and automate project provisioning and billing linkage to prevent shadow IT and unmanaged cost sprawl. Provide private network isolation between environments while allowing developers to provision compute workloads using pre-allocated enterprise IP subnets. Which resource hierarchy and access governance architecture should the organization deploy?

Organize top-level folders by environment (`Production`, `Non-Production`), nest business unit subfolders within each environment, deploy environment-specific Shared VPC host projects managed by a central network team, restrict project creation and billing linkage to an automated provisioning service account, and grant developers subnet-level network user permissions in their service projects.: ### What the environment-first hierarchy and centralized provisioning model is An **environment-first multi-level folder structure** places top-level folders according to lifecycle stages (such as `Production` and `Non-Production`) beneath the root **Organization node**, with departmental or business unit folders nested underneath. Project provisioning and **Cloud Billing** attachments are strictly governed via a centralized automation pipeline using dedicated **service accounts**, while network infrastructure is decoupled using **Shared VPC**. ### How it meets the security and governance requirements - **Policy inheritance & isolation**: Structuring top-level folders by environment allows administrators to attach restrictive **Organization Policies** (e.g., disabling external IP addresses, restricting resource locations) directly at the `Production` folder level without impacting `Development` flexibility. - **Separation of duties**: Central network administrators manage dedicated Shared VPC host projects in a separate infrastructure folder, while application teams only receive the **`roles/compute.networkUser`** role on designated subnets within their assigned service projects. - **Centralized project governance**: Restricting **`roles/resourcemanager.projectCreator`** and **`roles/billing.user`** to automated deployment service accounts eliminates unauthorized project creation, enforces standard naming conventions, and prevents shadow IT. - **Environment network isolation**: Operating discrete Shared VPC networks for each environment ensures that non-production resources cannot accidentally route traffic directly to production workloads. ### Key advantages and capabilities - **Predictable policy cascading**: Ensures high-security guardrails automatically apply to all newly created child subfolders and projects within production. - **Granular network control**: Subnet-level IAM assignment ensures developers can only attach workloads to authorized IP address ranges. - **Least-privilege billing enforcement**: Prevents developers from associating arbitrary projects with corporate billing accounts. - **Scalable multi-tenancy**: Enables independent team autonomy within individual service projects without granting access to core network routing or firewall policies. ### Why this is optimal This approach strikes the optimal balance between **centralized governance** (automated project provisioning, security policies, and network management) and **developer agility** (autonomous resource deployment within sandboxed service projects).

Design Compliant Resource Hierarchy Governance | Professional Cloud Security Engineer

Design Compliant Resource Hierarchy Governance

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is establishing a multi-tier Google Cloud resource hierarchy to support several business units with strict regulatory requirements across Development, Staging, and Production environments. The security architecture must satisfy the following constraints:

Enforce distinct environment-specific organization policies (such as location restrictions and external IP constraints) and prevent accidental inheritance of permissive non-production settings into production.
Implement strict separation of duties between central network administrators, security operators, and application development teams.
Centralize and automate project provisioning and billing linkage to prevent shadow IT and unmanaged cost sprawl.
Provide private network isolation between environments while allowing developers to provision compute workloads using pre-allocated enterprise IP subnets.

Which resource hierarchy and access governance architecture should the organization deploy?

Organize top-level folders by environment (Production, Non-Production), nest business unit subfolders within each environment, deploy environment-specific Shared VPC host projects managed by a central network team, restrict project creation and billing linkage to an automated provisioning service account, and grant developers subnet-level network user permissions in their service projects.

Create a single flat folder structure under the Organization node, deploy domain controllers inside each application project, assign the Billing Account Administrator role to development leads, and rely on project-level IAM policies without inherited folder constraints.

Deploy a decentralized hierarchy where each business unit folder is granted the Folder Admin role, permit each team to create standalone VPC networks per project connected via VPC Network Peering across environments, and synchronize domain local Active Directory security groups via a single GCDS instance.

Organize top-level folders by business unit, place development and production projects within the same business unit folder, deploy a single global Shared VPC host project for all environments, and grant application team leads the Project Creator and Billing User roles at the root Organization node.

Professional Cloud Security Engineer

Design Compliant Resource Hierarchy Governance

Related questions