A boolean organization policy constraint is enforced on a folder. A team then creates a new project inside that folder, and no policy is set directly on the project. How does the constraint apply to the new project?
- AThe constraint is inherited from the folder and enforced on the new project, because a project evaluates an effective policy built from every ancestor above it. Correct
- BThe constraint does not reach the project, because organization policies attach to the organization node and folders but stop above the project level.
- CThe constraint applies only after an administrator re-applies it on the project, since existing policies do not propagate to resources created after the policy is set.
- DThe constraint is inherited but downgraded to advisory, so violations on the project are recorded in Cloud Logging instead of being blocked.
Why A is correct: Correct: the effective policy for any node is the result of evaluating its own policy against those inherited from the folders and organization above it, so a folder constraint applies to child projects.
Why B is wrong: It sounds plausible if you assume policies protect only higher tiers, but organization policies attach to and are enforced at organization, folder, and project nodes alike.
Why C is wrong: The timing detail is tempting, but inheritance is evaluated dynamically at each request, so a project created later still inherits the folder policy without any manual re-application.
Why D is wrong: It borrows the idea of a dry-run mode, but an enforced organization policy actively blocks non-compliant actions rather than merely logging them as advisory events.