nerdexam
Google

PROFESSIONAL-CLOUD-ARCHITECT · Question #372

A large, multinational corporation is migrating to Google Cloud. The company has several distinct business units: Finance, Marketing, and Research and Development (R&D). The central security team has

The correct answer is A. Create a folder for each department under the root Organization node. Apply the resource. Using folders per business unit enables scalable policy enforcement and delegated administration. Applying the resource location restriction at the Finance folder level enforces compliant regions for all Finance projects, while IAM on that folder allows tight control via the fina

Submitted by layla.eg· Mar 30, 2026Designing and planning a cloud solution architecture

Question

A large, multinational corporation is migrating to Google Cloud. The company has several distinct business units: Finance, Marketing, and Research and Development (R&D). The central security team has mandated governance requirements for each business unit:. - Finance: Must be restricted to deploying resources only in specific, compliant regions (us-central1 and europe-west2). Access to their projects must be tightly controlled by a dedicated finance-admins group. - Marketing: Needs separate environments for production and development, with different teams managing each environment. - R&D: Requires maximum flexibility to experiment with new services but must be completely isolated to prevent any impact on production systems. - Global Auditing: A central compliance team requires read-only access to view all resources across the entire company for auditing purposes. You need to design a resource hierarchy that enforces these security policies at scale according to the Google Cloud Well-Architected Framework while providing the correct level of autonomy for each business unit. What should you do?

Options

  • ACreate a folder for each department under the root Organization node. Apply the resource
  • BPlace all projects directly under the Organization node. Use network tags and service accounts to
  • CCreate separate Google Cloud Organizations for each department (Finance, Marketing, and
  • DCreate a single project for each department. Apply the resource location policy directly to the

How the community answered

(29 responses)
  • A
    79% (23)
  • B
    3% (1)
  • C
    10% (3)
  • D
    7% (2)

Explanation

Using folders per business unit enables scalable policy enforcement and delegated administration. Applying the resource location restriction at the Finance folder level enforces compliant regions for all Finance projects, while IAM on that folder allows tight control via the finance-admins group. Separate Marketing projects for production and development provide clear environment separation and independent administration. Keeping R&D within its own folder supports strong isolation from production through folder-level policies and IAM while still allowing flexibility. Granting the auditing team read-only access at the Organization level provides consistent visibility across all resources without per-project management overhead.

Topics

#Resource hierarchy#Org folders#Resource location constraints#IAM governance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-ARCHITECT Practice