Question-53: The principle of least privilege, often known as POLP, is a concept in computer security that restricts the access permissions of users to just those things that are absolutely necessary for them to do their duties. Users are only allowed authorization to read, write, or execute those files and resources that are essential to the completion of their tasks. The security team at QuickTechie Inc. demands that all infrastructure on Google Cloud Platform be deployed using a model with the least amount of privilege possible, along with separation of roles for administration between production and development resources. A separation of tasks ensures that no one person has complete authority over the whole of the process by which a transaction is carried out. In an ideal world, a transaction should not be able to be started, recorded, authorized, or reconciled by a single individual. What kind of Google domain and project structure do you suggest we use?
A. For the purpose of user management, you should set up two separate G Suite accounts: one for development/test/staging, and another for production. Each application should have one project associated with its corresponding account.
B. Create two G Suite accounts to manage users: one with a single project for all apps in development, and another with a single project for all applications in production.
C. Establish a single G Suite account in order to manage users, organising each step of the application development process as its own project.
D. Create a single G Suite account to manage users, with one project for the environment that is used for development, testing, and staging, and one project for the environment that is used for production.
Correct Answer

Get All 340 Questions and Answer for Google Professional Cloud Architect

: 3 Explanation: Here are the correct answers: Refer to the diagram on top, different envs are created at the project level. A general recommendation is to have one project per application per environment. For example, if you have two applications, app1 and app2, each with a development and production environment, you would have four projects: app1-dev, app1-prod, app2-dev, app2-prod. This isolates the environments from each other, so changes to the development project do not accidentally impact production, and gives you better access control, since you can (for example) grant all developers access to development projects but restrict production access to your CI/CD pipeline. Option-3 is best practice as recommended by google.