Google Cloud Professional Cloud Network Engineer — Question 90

You are the Organization Admin for your company. One of your engineers is responsible for setting up multiple host projects across multiple folders and sharing subnets with service projects. You need to enable the engineer's Identity and Access Management (IAM) configuration to complete their task in the fewest number of steps. What should you do?

Answer options

• A. Set up the engineer with Compute Shared VPC Admin IAM role at the folder level.
• B. Set up the engineer with Compute Shared VPC Admin IAM role at the organization level.
• C. Set up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin role at the folder level.
• D. Set up the engineer with Compute Shared VPC Admin IAM role and Project IAM Admin role at the organization level.

Correct answer: B

Explanation

The correct choice is B because granting the Compute Shared VPC Admin IAM role at the organization level allows the engineer to manage shared VPCs across all projects and folders within the organization. Options A and C limit the engineer's permissions to specific folders, which could complicate their task. Option D, while giving broader permissions, adds unnecessary complexity with the Project IAM Admin role, which is not needed for the specific task at hand.