Question

Your company runs a production billing project in Google Cloud that contains critical revenue-processing resources. Leadership is concerned that an engineer with the Owner role could accidentally delete the entire project. Security must ensure that no one can delete this specific project until an explicit protective control is removed, while still allowing normal day-to-day resource management to continue. Which action best meets this requirement?

Accepted Answer

Place a project lien on the billing project so that deletion attempts are blocked until the lien is removed.

Answer

Remove the Owner role from all engineers and grant only the Editor role to prevent project deletion.

Answer

Apply an organization policy constraint that restricts project creation across the organization.

Answer

Enable a deny policy that blocks all resourcemanager.projects.* permissions for the engineering group.