A global online retailer uses Google Cloud with a multi-level resource hierarchy: Organization Root → Production Folder → E-Commerce Folder → Payment-Service Project. An Organization Policy applied at the Production Folder sets the `gcp.resourceLocations` constraint to `allowedValues: ["in:us-locations"]` with `inheritFromParent: false`. The security team now needs to permit a specialized payment module inside the Payment-Service Project to deploy resources in `europe-west3`, while ensuring three strict governance rules:
1. All sibling projects under the E-Commerce Folder must remain restricted to `us-locations`.
2. Any new location constraints added at the Organization Root or Production Folder in the future must automatically merge and apply to the Payment-Service Project.
3. The security team must test a new constraint restricting public IP addresses (`compute.vmExternalIpAccess`) across the Production Folder to measure compliance impact without blocking active developer deployments.
Which combination of Organization Policy configurations correctly fulfills all security and operational requirements?
- At the Payment-Service Project level, configure `gcp.resourceLocations` with `allowedValues: ["europe-west3"]` and set `inheritFromParent: true`. At the Production Folder level, apply `compute.vmExternalIpAccess` in dry-run mode.Cevap
- BGrant the primitive Owner role (`roles/owner`) to the Payment-Service Project leads so their deployments bypass folder-level Organization Policies, while enforcing `compute.vmExternalIpAccess` directly at the project level.
- CEstablish a VPC Service Controls perimeter encompassing the Payment-Service Project to allow `europe-west3` data access, while configuring an egress rule to audit public IP address usage across the Production Folder.
- DGrant the `roles/iam.serviceAccountUser` role at the Organization Root to the deployment service account, allowing it to modify the `gcp.resourceLocations` enforcement behavior on the Payment-Service Project.