Exam Professional Cloud Security Engineer topic 1 question 304 discussion

The correct answer is C. A is not possible because you can't assign a custom role to folders.

A is the best approach, although it's worded slightly confusingly. The correct pattern is to grant a role with the necessary permissions (like a custom role with orgpolicy.policy.set or the built-in Organization Policy Administrator role) directly on each team's respective folder, which is the most direct way to enforce the principle of least privilege and minimize complexity.

Key Requirements: Teams need flexibility to modify policies relevant only to their work. Must align with Google-recommended security practices (principle of least privilege). Minimize administrative complexity. Why A is Correct: Custom Role: By creating a custom IAM role with specific permissions, you ensure teams can only manage policies relevant to their folder. Granular Access: Granting the custom role to each team's folder ensures they only have permissions for policies within their scope of responsibility. Minimized Risk: This approach avoids over-permissioning and prevents accidental or malicious policy changes at the organization level. Alignment with Best Practices: Adheres to the principle of least privilege and ensures resource-level isolation.

Answer is C. The only inputs accepted while defining a new custom role are: Title, Description, ID, Role launch stage & permissions. Any other option like "Limit policy modifications based on folder names" is non-existing within the custom role’s definition as Option A states. https://cloud.google.com/iam/docs/creating-custom-roles#creating

Answer is C. The only inputs accepted while defining a new custom role are: Title, Description, ID, Role launch stage & permissions. Any other option like "Limit policy modifications based on folder names" is non-existing within the custom role’s definition as Option A states. https://cloud.google.com/iam/docs/creating-custom-roles#creating

Tags in Google Cloud are primarily designed for organizing and categorizing resources.While it's possible to create IAM conditions that reference tags (e.g., limiting the use of a role to resources with specific tags), this method is not the most intuitive or straightforward way to manage IAM policies, especially when the main goal is to provide flexible policy management for different teams. In your case, folder-based isolation with custom IAM roles is a cleaner and more intuitive way to achieve team-level control over organization policies

It's C.

C - Granular Control: Creating an organization-level tag allows you to precisely control which teams have access to modify organization policies by attaching the tag to relevant folders. This ensures that only authorized teams can make changes. IAM Condition: Using an IAM condition to restrict the organization policy administrator role to resources with the tag provides a flexible and efficient way to grant permissions while maintaining control. This ensures that the role is only accessible for the intended teams. Security Best Practices: This approach aligns with Google-recommended security practices by limiting access to organization policies to authorized teams and using IAM conditions to enforce appropriate controls. Administrative Efficiency: This approach simplifies administration by providing a centralized mechanism for managing permissions and ensuring that only authorized teams can modify organization policies.