Setting Resource Location Restriction at Project Level

PCSE By islever Editorial Last updated

Defining the resource hierarchy. Automating infrastructure and application security.

Short answer

C The Resource Location Restriction constraint must be set at the Project level to allow specific data residency requirements per project while supporting multiple locations within the parent folder hierarchy.

Question

Your company's Chief Information Security Officer (CISO) creates a requirement that business data must be stored in specific locations due to regulatory
requirements that affect the company's global expansion plans. After working on the details to implement this requirement, you determine the following:
✑ The services in scope are included in the Google Cloud Data Residency Terms.
✑ The business data remains within specific locations under the same organization.
✑ The folder structure can contain multiple data residency locations.
You plan to use the Resource Location Restriction organization policy constraint. At which level in the resource hierarchy should you set the constraint?
  1. Folder
  2. Resource
  3. Project Correct Answer
  4. Organization

Key Takeaways

The main trap is assuming higher-level constraints (Organization or Folder) are better for security; however, the requirement for 'multiple data residency locations' within folders necessitates the granular control offered by Project-level constraints.

This page explains why the Resource Location Restriction organization policy constraint should be applied at the Project level in Google Cloud to satisfy specific data residency requirements without limiting folder-level diversity.

Common mistake: Many candidates choose Folder (A) or Organization (D) because they believe centralized control is safer. This is incorrect because these higher levels would force all contained resources into the same location(s), violating the condition that folders can hold multiple distinct residency locations.

Expert Analysis

The question tests the application of Google Cloud's Resource Location Restriction organization policy constraint within the resource hierarchy, specifically balancing regulatory compliance with architectural flexibility.

The key to this decision lies in interpreting the constraint: "The folder structure can contain multiple data residency locations." If you apply the constraint at the Organization level, all resources across the entire enterprise are restricted to a single set of locations, eliminating the ability to have different regions for different business units. Similarly, applying it at the Folder level would restrict all projects under that folder to the same location(s), contradicting the requirement that folders can host multiple distinct residency locations.

Applying the constraint at the Project level provides the necessary granularity. Each project represents a specific workload or business unit. By setting the constraint at the project level, you can enforce strict data residency rules for individual services while allowing the broader folder structure to accommodate diverse geographic requirements. Comments highlighting that policies should be applied at the "lowest child possible" where needed support this logic, ensuring that restrictions do not inadvertently block valid multi-region architectures higher up the hierarchy. Therefore, the Project level is the correct scope to meet both the regulatory need and the structural flexibility described.

Official Reference

https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations

This link opens the official vendor documentation in a new tab.

Exam Strategy

When faced with organization policy questions, always look for keywords indicating diversity or variation (e.g., 'multiple locations', 'different regions'). If the scenario requires different settings for similar entities, the constraint must be applied at the lowest common denominator in the hierarchy (Project) rather than a higher aggregate level (Folder/Org) that would force uniformity.

Frequently Asked Questions

Can I apply Resource Location Restrictions at the Resource level?

No, organization policy constraints like Resource Location Restriction are applied at the Organization, Folder, or Project level. They cannot be applied directly to individual resources.

Why not use Organization level for global compliance?

While Organization level ensures consistency, it forces all resources globally to adhere to the same location constraints. If your business needs different data residency locations for different departments, Project-level constraints provide the necessary flexibility.

More PCSE FAQ →

Community Votes

C
61%
A
28%
B
6%
D
5%

61% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 31 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 31

  1. mouchu 👍 24
    Answer = C "The folder structure can contain multiple data residency locations" suggest that restriction should be applied on projects level
  2. Taliesyn 👍 6 Answered A
    Org policies can't be applied on resources ...
  3. Anonymous learner 👍 4 Answered C
    These restrictions can be applied at Org level, Folder Level or Project Level, but not resource level. Also, these policies are inherited, which means they need to be applied at the lowest child possible in the hierarchy where this is needed, not higher. This makes the answer specific to the use case rather than textbook knowledge. According to the given: "The folder structure can contain multiple data residency locations". This means that applying location restrictions at the Folder level or above will violate the requirement.This means you must apply the constraint at Project level. Quotes from the references below: "You can also apply the organization policy to a folder or a project with the folder or the project flags, and the folder ID and project ID, respectively." - no mention of resource level References: https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy https://cloud.google.com/resource-manager/docs/organization-policy/using-constraints
  4. GHOST1985 👍 4 Answered A
    Answer A, the requirement says :"The business data remains within specific locations under the same organization" that's mean you need to set up the restriction at higher level so folder is the correct answer => Answer A
  5. szl0144 👍 4 Answered C
    C is the answer, already have the organization policy to set all data in the same region but need to change the policy at the folder level
Show 25 more comments
  1. Rightsaidfred 👍 4 Answered C
    Different Locations therefore needs to be applied at Project Level.
  2. fad3r 👍 3
    A lot of madness in these answers. It is C. You cant apply it at the org level since that effects everything. You cant apply it at the folder level since can contain locations. You CAN apply it at the project level. For those who say you cant apply these policies at the org level I suggest you spend more time reading docs and testing things in a lab. https://cloud.google.com/blog/products/identity-security/meet-data-residency-requirements-with-google-cloud To strengthen these controls further, Google Cloud offers Organization Policy constraints which can be applied at the organization, folder, or project level
  3. AzureDP900 👍 3
    Yes, It is C. This is very tricky question and we need to read very carefully. In general Folders will used but in this case Project is right
  4. gcpengineer 👍 3 Answered C
    C is the ans
  5. Anonymous learner 👍 2
    "C" Project Level These restrictions can be applied at Org level, Folder Level or Project Level, but not resource level. Also, these policies are inherited, which means they need to be applied at the lowest child possible in the hierarchy where this is needed, not higher. This makes the answer specific to the use case rather than textbook knowledge. According to the given: "The folder structure can contain multiple data residency locations". This means that applying location restrictions at the Folder level or above will violate the requirement.This means you must apply the constraint at Project level. Quotes from the references below: "You can also apply the organization policy to a folder or a project with the folder or the project flags, and the folder ID and project ID, respectively." - no mention of resource level References: https://cloud.google.com/resource-manager/docs/organization-policy/understanding-hierarchy https://cloud.google.com/resource-manager/docs/organization-policy/using-constraints
  6. piyush_1982 👍 2 Answered D
    I think D is the best solution. https://cloud.google.com/assured-workloads/docs/concept-data-residency Organizations with data residency requirements can set up a Resource Locations policy that constrains the location of new in-scope resources for their whole organization or for individual projects. As per the link above it says for such a requirement you can set up the resource location constraint at Org or Individual Project level. Setting up at the individual project level will be exhausting hence setting up at Org level would be the best way to move forward.
  7. desertlotus1211 👍 2
    https://cloud.google.com/assured-workloads/docs/data-residency#:~:text=Organizations%20with%20data%20residency%20requirements,select%20your%20desired%20compliance%20program. Organizations with data residency requirements can set up a Resource Locations policy that constrains the location of new in-scope resources for their whole organization or for individual projects. Answer C is a better choice, though this documenttalks about folders. But the questions says there are multiple data residency locations in that folders, so project level seems to be the best.
  8. AnishAd 👍 2
    C it is ----> Imp line to read from Question to understand why At Project level : 1. business data must be stored in specific locations due to regulatory requirements & The folder structure can contain multiple data residency locations. --- > Since Folder is going to contain multiple data residency locations and requirement is to restrict in specific location , so Constraints should be set at project level.
  9. rotorclear 👍 2 Answered C
    I initially thought it will be folder but there are multiple data residencies in a folder hence it will conflict
  10. marrechea 👍 2 Answered C
    As "The folder structure can contain multiple data residency locations." it has to be at project level
  11. alleinallein 👍 2 Answered C
    Project level seems to be reasonable.
  12. AzureDP900 👍 2
    C is right in my poinion.
  13. AzureDP900 👍 2
    C is right
  14. piyush_1982 👍 2
    why not D?
  15. Mauratay 👍 1 Answered B
    Reference: https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations#overview A policy that includes this constraint will not be enforced on sub-resource creation for certain services, such as Cloud Storage and Dataproc. https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy#inheritance Cloud Storage is a resource eligibile for location constraints. All other options would be viable with the use of value groups, at either org, folder or project level, however, the only clue here is their data to be stored, which points to cloud storage. https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations#value_groups
  16. mikesp 👍 1 Answered A
    Since it is possible to set org policy constraints at project and folder level and "The folder structure can contain multiple data residency locations", i would set the policy at folder level. https://cloud.google.com/resource-manager/docs/organization-policy/using-constraints "You can also apply the organization policy to a folder or a project with the --folder or the --project flags, and the folder ID and project ID, respectively."
  17. Bettoxicity 👍 1 Answered A
    A Why not C?: Project-level constraints wouldn't offer the desired level of granularity. You might have data in a single project that needs to be stored in different locations based on regulations. Why no D?: Organization: An organization-level constraint would restrict all resources within the organization to a single residency location, which wouldn't meet the need for differentiated locations for various data sets.
  18. TonytheTiger 👍 1
    To set an organization policy including a resource locations constraint: https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations
  19. BPzen 👍 1 Answered C
    "The folder structure can contain multiple data residency locations" suggest that restriction should be applied on projects level
  20. irmingard_examtopics 👍 1 Answered C
    Project Level: Used when individual projects within the same folder require strict isolation to different specific locations.
  21. adelynllllllllll 👍 1
    the answer should be B https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations
  22. AzureDP900 👍 1
    137 and 133 questions are similar except ✑ The projects are aligned to specific locations.
  23. cjjatta 👍 1 Answered C
    The folder structure can contain multiple data residency locations
  24. AzureDP900 👍 1
    Q 137 is same
  25. dija123 👍 1 Answered C
    Agree with C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

Integrating On-Premises Active Directory with Google Cloud IAM

S-grade

Cloud External Key Manager and Confidential VM Implementation Constraints

S-grade

← Back to PCSE Study Guide