In a typical cloud hierarchy (e.g., Google Cloud), what is the correct order from highest to lowest level?

Organization → Projects → Folders → Resources

Projects → Organization → Folders → Resources

Organization → Folders → Projects → Resources

Folders → Organization → Projects → Resources

What is the relationship between folders and projects in a cloud hierarchy?

Folders can contain projects and other folders, creating a nested structure

Folders and projects are independent and cannot be nested

Projects are always at the top level, and folders are used only for billing

Projects can contain folders and other projects

A startup is growing quickly and expects to add many new projects and teams. They want a hierarchy that is easy to manage and scales without requiring frequent restructuring. What is the best practice for designing their cloud hierarchy?

Create a single project for all resources and use tags to separate teams.

Create a flat structure with all projects directly under the organization node.

Create a separate organization for each team.

Create folders for teams or products and attach common policies at the folder level.

What is a best practice when designing a cloud hierarchy?

Place all resources in a single project to simplify management

Avoid using folders and rely solely on resource-level tags

Keep the hierarchy relatively flat and use folders to group resources by environment or business unit

Create a separate folder for every individual resource

A company has an organization-level policy that grants all employees view access to all projects. A folder-level policy denies a specific team view access to a folder. A project-level policy grants that same team view access to a specific project within the folder. What is the effective access for the team on that project?

The team has view access because the project-level grant is more specific than the folder-level deny.

The team has view access because the organization-level grant is the highest-level policy.

The team has view access only if the project-level grant is also denied at the folder level.

The team does not have view access because the folder-level deny overrides both the organization-level grant and the project-level grant.

GIAC Cloud Security Architecture and Design

Domain 5Objective 2

Hierarchical Cloud Structures GCAD Practice Questions (Page 4)

Part of the Zero Trust and Governance domain, which makes up ~10% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–8 in this domain), expect 3–4 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

7concepts

Questions 16–20

16foundation · easy
In a typical cloud hierarchy (e.g., Google Cloud), what is the correct order from highest to lowest level?
Select an answer first
17foundation · easy
What is the relationship between folders and projects in a cloud hierarchy?
Select an answer first
18application · medium
A startup is growing quickly and expects to add many new projects and teams. They want a hierarchy that is easy to manage and scales without requiring frequent restructuring. What is the best practice for designing their cloud hierarchy?
Select an answer first
19foundation · easy
What is a best practice when designing a cloud hierarchy?
Select an answer first
20expert · hard
A company has an organization-level policy that grants all employees view access to all projects. A folder-level policy denies a specific team view access to a folder. A project-level policy grants that same team view access to a specific project within the folder. What is the effective access for the team on that project?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCAD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCAD” is a trademark of its owner, used for identification only.