Your team needs to ensure that Compute Engine instances in your production project cannot have public IP addresses, except for the frontend application instances which require them. The product engineers have the Editor role and can modify resources. How can your team enforce this requirement?

Exam-Like

Enable Private Access on the VPC network in the production project.

Remove the Editor role and grant the Compute Admin IAM role to the engineers.

Set up an organization policy to only permit public IPs for the front-end Compute Engine instances.

Set up a VPC network with two subnets: one with public IPs and one without public IPs.

Google Professional Cloud Security Engineer