2.3. Reflection Checkpoint

Key Takeaways

• Resource hierarchy setup and IAM/Cloud Identity configuration happen once but compound in impact for the life of the environment — mistakes here are the hardest kind to catch because nothing looks broken until an audit or incident.
• Organization Policy and IAM answer different questions: Organization Policy restricts what configurations are allowed at all, while IAM controls who can act within whatever the policy permits.
• Disabled APIs and exhausted quotas are both failure modes that can look like permission errors on the surface — recognizing which one you're actually looking at determines the fix.
• Billing accounts are independent of the resource hierarchy by design, linking to projects rather than living inside Folders — and a budget is a notification threshold, not an automatic spending cap.

Connecting Forward

With the environment properly set up and billing configured, Phase 3 moves into the exam's largest single domain: actually planning and implementing the compute, storage, networking, and tooling choices that turn an empty project into a running solution.

Self-Check Questions

• Can you explain, without re-reading 2.1.1, why an Organization Policy restriction can block an action that a project Owner's IAM role would otherwise permit?
• If a stakeholder assumes setting a $10,000 monthly budget guarantees spend can never exceed that amount, what would you tell them is actually happening once that threshold is crossed?