GCP Professional Cloud Security Engineer Practice Question

Because the Viewer role is bound at the Organization level, it is inherited by all descendant folders and projects. IAM does not let you "un-inherit" an allow binding on a lower resource, and re-creating per-project bindings would be error-prone and violate least-privilege. Instead, you can attach an IAM Deny policy to the mna-risk-analysis project that explicitly denies the resourcemanager.projects.get and other viewer permissions to the [email protected] group. An IAM Deny entry always overrides inherited allow bindings, so the auditors keep their organization-wide read access everywhere except this project. Moving the project to another organization or disabling the group's Viewer role at the organization level would remove required access elsewhere, and adding another allow binding with conditions does not negate an inherited allow.