GCP Associate Cloud Engineer Practice Question

The Organization Policy Service lets you define constraints that are inherited down the resource hierarchy and selectively overridden lower in the tree. By setting the constraints/compute.vmExternalIpAccess constraint to DENY at the Organization level, all descendant folders, projects, and resources will, by default, be prevented from assigning external IPv4 addresses to new VMs. You can then create an override policy on the Dev folder that allows external IP assignment, enabling teams in that folder to create public VMs without affecting the stricter default applied to Prod. Applying individual project-level policies or manipulating firewall rules, routes, or API enablement would require more effort to maintain and would not reliably prevent the assignment of external IP addresses.