Multiple departments need project-level access with identical role sets per department. You want minimal maintenance and clear IAM oversight following Google best practices. How should you organize IAM and projects?

The correct answer uses Google Groups for managing department members, which simplifies user administration. Granting permissions at the folder level ensures that all projects within that folder inherit the same permissions, providing consistent access control for each department. This approach aligns with Google Cloud best practices for hierarchical resource management and least privilege, offering minimal maintenance and clear oversight. Granting permissions directly to individual members (first and third options) is less scalable and harder to manage, especially with staff changes. Granting permissions at the project level (fourth option) would require managing permissions for each project individually, increasing overhead compared to folder-level permissions.