Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise organization manages a Google Cloud resource hierarchy consisting of an Organization node, several environment folders (Production, Staging, Development), and dozens of child projects. The security team wants to implement tag-based access control (TBAC) with IAM Conditions to grant the Cloud Operations team (cloud-ops@example.com) administrative permissions across virtual machines under the following requirements:
StudyCerts
StudyCertsroles/compute.admin dynamically only on resources evaluated with the environment: production tag value.Production folder must automatically inherit production tag enforcement without requiring per-project configuration, while allowing descendant resources to override the tag value when necessary.Which strategy should the security engineer implement?
Bind the tag value environment: default to the Organization resource, attach the tag value environment: production to each project under the Production folder, and grant roles/compute.admin using an IAM condition with resource.matchTag() using namespaced names.
Apply resource labels with env=production to compute instances, configure a custom organization policy to enforce the label across folders, and grant roles/compute.admin conditionally using resource.labels in the IAM policy binding.
Bind the tag value environment: default to the Organization resource, attach the tag value environment: production to the Production folder, and grant roles/compute.admin to cloud-ops@example.com at the organization level using an IAM condition with resource.matchTagId() referencing the permanent tag key and value IDs.
Attach the tag value environment: production directly to the Production folder, grant roles/compute.admin unconditionally at the folder level, and deploy an Organization Policy with a DENY rule matching !resource.hasTagKeyId().
Bind the tag value environment: default to the Organization resource, attach the tag value environment: production to each project under the Production folder, and grant roles/compute.admin using an IAM condition with resource.matchTag() using namespaced names.
Apply resource labels with env=production to compute instances, configure a custom organization policy to enforce the label across folders, and grant roles/compute.admin conditionally using resource.labels in the IAM policy binding.
Bind the tag value environment: default to the Organization resource, attach the tag value environment: production to the Production folder, and grant roles/compute.admin to cloud-ops@example.com at the organization level using an IAM condition with resource.matchTagId() referencing the permanent tag key and value IDs.
This architecture combines Resource Manager tag inheritance, safe default tag bindings, and IAM Conditions using permanent resource IDs (tagKeys/KEY_ID and tagValues/VALUE_ID) to dynamically enforce least-privilege administrative access across the Google Cloud resource hierarchy.
environment: default at the root Organization resource ensures that all descendant folders, projects, and resources automatically inherit a baseline non-production tag state through hierarchy inheritance.environment: production directly to the Production folder overrides the organization-level safe default for that entire subtree. All child projects and compute instances under the Production folder automatically compute an effective tag of environment: production without manual project-level tagging, while retaining the capability to be overridden at lower levels if needed.roles/compute.admin at the organization level with a condition using resource.matchTagId() ensures that members of cloud-ops@example.com only obtain administrative rights when acting against resources whose effective tags match the production tag identifier.tagKeys/123456789012 and tagValues/567890123456) ensures that if a tag key or value is deleted and subsequently recreated with identical short names or namespaced names, unauthorized access is not unintentionally restored or granted to the new tag resources.This approach aligns with Google Cloud security best practices by implementing safe defaults at the root node, delegating environment-specific governance to folder structures, and utilizing immutable permanent identifiers in IAM CEL expressions to eliminate privilege escalation vectors.
Attach the tag value environment: production directly to the Production folder, grant roles/compute.admin unconditionally at the folder level, and deploy an Organization Policy with a DENY rule matching !resource.hasTagKeyId().