Google Cloud Professional Cloud Security Engineer — Question 227

Your team needs to prevent users from creating projects in the organization. Only the DevOps team should be allowed to create projects on behalf of the requester.
Which two tasks should your team perform to handle this request? (Choose two.)

Answer options

• A. Remove all users from the Project Creator role at the organizational level.
• B. Create an Organization Policy constraint, and apply it at the organizational level.
• C. Grant the Project Editor role at the organizational level to a designated group of users.
• D. Add a designated group of users to the Project Creator role at the organizational level.
• E. Grant the billing account creator role to the designated DevOps team.

Correct answer: A, D

Explanation

Option A is correct because removing all users from the Project Creator role ensures that no one except the designated DevOps team can create projects. Option D is incorrect; adding a group to the Project Creator role would allow additional users to create projects, which contradicts the requirement. The other options do not directly address the need to restrict project creation permissions effectively.