Google Cloud Professional Cloud Security Engineer Practice Exam

To automatically grant read-only access to all department members for new projects, what is the recommended configuration?

1. Create a new project for each department

2. Create a Folder per department and assign Project Viewer role to Google Group

3. Use IAM roles for individual users

4. Implement Google Groups for all employees

The correct answer is: Create a Folder per department and assign Project Viewer role to Google Group

The recommended configuration of creating a Folder per department and assigning the Project Viewer role to a Google Group is effective because it allows for centralized management of permissions while promoting automation and scalability. By organizing projects under departmental folders, any new project created within that folder will inherit the permissions set at the folder level, which simplifies the process of granting read-only access. This means that when a new project is added to the folder, all members of the designated Google Group automatically receive the Project Viewer role without the need for individual configurations. This approach minimizes administrative overhead, ensuring that access is consistent and easily manageable as team members come and go. Additionally, it allows for clear organizational structure and visibility into what is accessible to each department, facilitating better security and compliance practices. Other configurations may not effectively meet the requirement for automation and management. For instance, creating a new project for each department would lead to redundancy and require separate permissions management for each project. Using IAM roles for individual users can be cumbersome to manage as it increases the number of configurations needed and does not easily accommodate new project additions. Implementing Google Groups for all employees, while beneficial for grouping, does not inherently control access levels to projects without an explicit role assignment, leaving significant access management to manual handling.