A customer has 300 engineers. The company wants to grant different levels of access and efficiently manage IAM permissions between users in the development and production environment projects. Which…

Creating a project with multiple VPC networks is a networking configuration and does not directly address the hierarchical management of IAM permissions across development and production environments.

Creating separate folders for development and production environments establishes a clear hierarchical structure, allowing IAM policies defined at the folder level to inherit down to all contained projects, effectively separating and managing access for each environment.

Using Google Groups for the engineering team and assigning permissions at the folder level allows for efficient management of access control at scale, as roles are granted once to a group, and all members of that group automatically inherit those permissions, simplifying user onboarding and offboarding.

Organizational Policy constraints define rules for resource configurations and behavior, but they are not used for granting user or group access control permissions.

While creating projects for each environment is appropriate, granting IAM rights to each individual engineering user is highly inefficient for 300 users and does not meet the requirement for efficient management compared to using groups.