You are responsible for the Google Cloud environment in your company. Multiple departments need access to their own projects, and the members within each department will have the same project responsibilities. You want to structure your Google Cloud environment for minimal maintenance and maximum overview of IAM permissions as each department's projects start and end. You want to follow Google-recommended practices. What should you do?

The correct option leverages Google Groups and folders for efficient IAM management. Creating a Google Group per department allows you to manage user access centrally; adding or removing a user from the group automatically updates their permissions across all associated resources. Applying IAM permissions at the folder level ensures that all projects within that folder inherit those permissions, simplifying management as projects are created or deleted. This approach minimizes maintenance and provides a clear overview of permissions, aligning with Google's best practices for hierarchical resource organization. The other options are less efficient: Granting individual members permissions directly is cumbersome and difficult to maintain. Granting permissions to individual members at the folder level still requires managing each user separately. Granting groups permissions at the project level means you'd have to apply permissions to every new project, which is not scalable.