1.5 Defining the Resource Hierarchy PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company needs to enforce a policy that all Cloud Storage buckets must have a specific custom label, 'cost-center', applied. No predefined organization policy constraint exists for this. The security team must implement this using a custom organization policy. What is the correct approach?

   • ACreate a custom IAM role that includes the permission to add labels and assign it to all users who create buckets.
   • BUse a Cloud Function that runs on a schedule to scan all buckets and delete any that do not have the 'cost-center' label.
   • CGrant the 'Storage Admin' role to the security team so they can manually add labels to any bucket that is missing them.
   • DCreate a custom constraint using the Organization Policy Service that checks for the presence of the 'cost-center' label on bucket creation, then apply it at the organization level.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the effect of setting a more restrictive IAM policy at a project level when a less restrictive policy is inherited from the folder?

   • AThe project-level policy overrides the inherited policy, and the inherited permissions are removed.
   • BThe inherited policy takes precedence, and the project-level policy is ignored.
   • CBoth policies are combined, so the effective permissions are the union of both.
   • DThe project-level policy is applied only to new resources, not existing ones.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which service is used to create and manage custom organization policy constraints?

   • ACloud Resource Manager
   • BOrganization Policy Service
   • CCloud IAM
   • DCloud Audit Logs
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the top-level node in the Google Cloud resource hierarchy?

   • AOrganization
   • BProject
   • CResource
   • DFolder
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When you move a project from one folder to another, what happens to the IAM policies that were set on the project?

   • AThey are replaced by the policies of the new folder.
   • BThey are deleted and must be recreated.
   • CThey remain intact, but the project now inherits policies from the new folder.
   • DThey are moved to the new folder and applied to all other projects in that folder.
   Reveal Solution Discussion Select an answer first