An enterprise organization is structuring its Google Cloud resource hierarchy to maintain a strict separation of duties across departments. The company must satisfy the following security and governance requirements: The Central Security and Compliance team must have read-only visibility and organizational policy enforcement across all environments without possessing permissions to deploy, edit, or delete application workloads. Development teams must have permissions to create and manage compute resources only within their respective departmental workload folders. Permissions granted at higher administrative levels must not accidentally confer workload modification privileges across child resources. Which resource hierarchy and access management architecture should the organization implement?

Define separate departmental folders beneath the Organization resource; assign the Security team the Organization Policy Administrator and Security Reviewer roles at the Organization level, and assign Development teams project-level resource admin roles within their specific departmental folders.: What the Recommended Architecture Is This architecture establishes a structured Google Cloud resource hierarchy utilizing top-level folders mapped by department, combined with distinct Identity and Access Management (IAM) role assignments at precise hierarchy tiers to maintain separation of duties. How It Meets the Requirements Independent Security Oversight: Granting the Central Security and Compliance team roles/orgpolicy.policyAdmin and roles/iam.securityReviewer (or roles/viewer) at the Organization node allows central administration of guardrails and read-only visibility across every child folder and project without granting workload deployment or data modification permissions. Departmental Workload Isolation: Assigning developer roles (such as roles/compute.instanceAdmin.v1 or roles/editor) scoped strictly to their respective departmental folders ensures development teams cannot affect neighboring business units. Controlled Permission Inheritance: Because IAM permissions inherit downward from parents to children, restricting administrative privileges to read/review at the organization level prevents accidental privilege creep down the hierarchy. Key Advantages and Capabilities Strict Functional Boundaries: Decouples governance and compliance enforcement from daily workload deployment and resource lifecycle operations. Centralized Guardrail Management: Allows the security team to define Organization Policies (such as restricting resource locations or disabling external IP addresses) uniformly across all child projects. Least Privilege Enforcement: Prevents developers in one department from viewing or altering infrastructure in another department. Scalable Governance: New projects added under departmental folders automatically inherit the proper compliance policies and read-only security oversight. Why This Is Optimal This model follows the principle of least privilege and strict segregation of duties. High-level access is limited to auditing and policy enforcement, while resource-creation privileges remain confined to leaf or departmental scopes.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Resource Hierarchy Separation Of Duties Boundary Enforcement

Section: Separation of duties

An enterprise organization is structuring its Google Cloud resource hierarchy to maintain a strict separation of duties across departments. The company must satisfy the following security and governance requirements:

The Central Security and Compliance team must have read-only visibility and organizational policy enforcement across all environments without possessing permissions to deploy, edit, or delete application workloads.
Development teams must have permissions to create and manage compute resources only within their respective departmental workload folders.
Permissions granted at higher administrative levels must not accidentally confer workload modification privileges across child resources.

Which resource hierarchy and access management architecture should the organization implement?

Define separate departmental folders beneath the Organization resource; assign the Security team the Organization Policy Administrator and Security Reviewer roles at the Organization level, and assign Development teams project-level resource admin roles within their specific departmental folders.

Place all departmental projects into a single flat hierarchy directly under the Organization node, and assign the Central Security team individual project-level Editor roles while assigning developers Organization-level Viewer roles.

Assign the Central Security team the Owner role at the Organization level, and assign Development teams the Editor role on the Organization node so both teams inherit necessary permissions across all folders.

Configure a single Shared folder containing all resources, grant the Central Security team Organization Admin, and configure service accounts with local project Owner roles that developers impersonate for all tasks.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Resource Hierarchy Separation Of Duties Boundary Enforcement

Section: Separation of duties

The Central Security and Compliance team must have read-only visibility and organizational policy enforcement across all environments without possessing permissions to deploy, edit, or delete application workloads.
Development teams must have permissions to create and manage compute resources only within their respective departmental workload folders.
Permissions granted at higher administrative levels must not accidentally confer workload modification privileges across child resources.

Which resource hierarchy and access management architecture should the organization implement?

Explanations

What the Recommended Architecture Is

This architecture establishes a structured Google Cloud resource hierarchy utilizing top-level folders mapped by department, combined with distinct Identity and Access Management (IAM) role assignments at precise hierarchy tiers to maintain separation of duties.

How It Meets the Requirements

Independent Security Oversight: Granting the Central Security and Compliance team roles/orgpolicy.policyAdmin and roles/iam.securityReviewer (or roles/viewer) at the Organization node allows central administration of guardrails and read-only visibility across every child folder and project without granting workload deployment or data modification permissions.
Departmental Workload Isolation: Assigning developer roles (such as roles/compute.instanceAdmin.v1 or roles/editor) scoped strictly to their respective departmental folders ensures development teams cannot affect neighboring business units.
Controlled Permission Inheritance: Because IAM permissions inherit downward from parents to children, restricting administrative privileges to read/review at the organization level prevents accidental privilege creep down the hierarchy.

Key Advantages and Capabilities

Strict Functional Boundaries: Decouples governance and compliance enforcement from daily workload deployment and resource lifecycle operations.
Centralized Guardrail Management: Allows the security team to define Organization Policies (such as restricting resource locations or disabling external IP addresses) uniformly across all child projects.
Least Privilege Enforcement: Prevents developers in one department from viewing or altering infrastructure in another department.
Scalable Governance: New projects added under departmental folders automatically inherit the proper compliance policies and read-only security oversight.

Why This Is Optimal

This model follows the principle of least privilege and strict segregation of duties. High-level access is limited to auditing and policy enforcement, while resource-creation privileges remain confined to leaf or departmental scopes.

View source documentation

Professional Cloud Architect

Resource Hierarchy Separation Of Duties Boundary Enforcement

Professional Cloud Architect

Resource Hierarchy Separation Of Duties Boundary Enforcement

What the Recommended Architecture Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions

OKR-Driven Phased Cloud Modernization