https://cloud.google.com/resource-manager/docs/organization-policy/org-policy- constraints#constraints-for-specific-services
- constraints/compute.restrictXpnProjectLienRemoval
- Restrict shared VPC project lien removal
This boolean constraint restricts the set of users that can remove a Shared VPC host project lien without organization-level permission where this constraint is set to True.
By default, any user with the permission to update liens can remove a Shared VPC host project lien. Enforcing this constraint requires that permission be granted at the organization level.

De-identifying sensitive data
Cloud Data Loss Prevention (DLP) can de-identify sensitive data in text content, including text stored in container structures such as tables. De-identification is the process of removing identifying information from data. The API detects sensitive data such as personally identifiable information (PII), and then uses a de-identification transformation to mask, delete, or otherwise obscure the data. For example, de-identification techniques can include any of the following:
Masking sensitive data by partially or fully replacing characters with a symbol, such as an asterisk (*) or hash (#).
Replacing each instance of sensitive data with a token, or surrogate, string.
Encrypting and replacing sensitive data using a randomly generated or pre-determined key.
When you de-identify data using the CryptoReplaceFfxFpeConfig or CryptoDeterministicConfig infoType transformations, you can re-identify that data, as long as you have the CryptoKey used to originally de-identify the data.
https://cloud.google.com/dlp/docs/deidentify-sensitive-data

A is not correct because Project owner is too broad. The security team does not need to be able to make changes to projects.
B is correct because:
- Org viewer grants the security team permissions to view the organization's display name.
- Project viewer grants the security team permissions to see the resources within projects.
C is not correct because Org admin is too broad. The security team does not need to be able to make changes to the organization.
D is not correct because Project owner is too broad. The security team does not need to be able to make changes to projects.
https://cloud.google.com/resource-manager/docs/access-control-org#using_predefined_roles

https://cloud.google.com/identity/solutions/enforce-mfa#use_security_keys Use security keys We recommend requiring security keys for those employees who create and access data that needs the highest level of security. You should require 2SV for all other employees and encourage them to use security keys.
Security keys offer the most secure form of 2SV. They are based on the open standard developed by Google as part of the Fast Identity Online (FIDO) Alliance. Security keys require a compatible browser on user devices.

Customer Managed Encryption keys using KMS lets users control the key management and rotation policies and Compute Engine Disks support CMEKs.
https://cloud.google.com/kubernetes-engine/docs/how-to/dynamic-provisioning-cmek