An enterprise organization maintains a Google Cloud resource hierarchy consisting of an Organization node, a top-level Folder named Finance-Dept, a child Folder named Payroll-Apps, and a Project named payroll-prod-db. An Organization Policy enforcing `constraints/compute.vmExternalIpAccess` (restricting external IP creation) is applied at the Finance-Dept folder level. A DevOps Team Lead must be allowed to create and manage new projects inside the Payroll-Apps folder, but must not be granted permissions to modify or delete the Payroll-Apps folder itself. Concurrently, a developer attempts to assign the primitive `roles/owner` role to a service account at the payroll-prod-db project level to allow Compute Engine instances to receive external IPs. Which statement correctly describes the administrative permission scoping and policy inheritance behavior across this hierarchy?
- Granting roles/resourcemanager.projectCreator at the Payroll-Apps folder level allows project creation within that folder without allowing folder modification, while the Organization Policy inherited from Finance-Dept prevents external IP creation regardless of project-level roles/owner assignments.Answer
- BGranting roles/owner at the project level grants full administrative autonomy, which overrides and neutralizes any Organization Policy constraints inherited from parent folders.
- CTo allow the Team Lead to create projects within Payroll-Apps, the primitive roles/owner role must be assigned at the Finance-Dept folder level.
- DCreating new projects under the Payroll-Apps folder automatically links those projects to the organization's primary billing account without requiring explicit billing account roles.