You have created an OS image that is hardened per your organization’s security standards and is being stored in a project managed by the security team. As a Google Cloud administrator, you need to make sure all VMs in your Google Cloud organization can only use that specific OS image while minimizing operational overhead. What should you do? (Choose two.)

To enforce organization-wide use of a specific OS image, you need two components: access permissions and policy enforcement. Option B grants users the compute.imageUser role in the security team's project, allowing them to use the hardened image. Option D implements the compute.trustedImageProjects organization policy constraint, which restricts VM creation to only use images from allowed projects. Together, these ensure all VMs can only use the approved hardened image while maintaining centralized management.

A. Granting compute.imageUser in users' own projects doesn't provide access to the security team's image.

C. Storing the image in every project creates unnecessary duplication and operational overhead.

E. Removing VM creation permissions from users is overly restrictive and creates operational bottlenecks.

1. Google Cloud Documentation - "Organization Policy Service" - Trusted Image Projects constraint (https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints)

2. Google Cloud Documentation - "Compute Engine IAM roles" - compute.imageUser role definition (https://cloud.google.com/compute/docs/access/iam)

3. Google Cloud Security Best Practices - "Image management and access control" (https://cloud.google.com/architecture/framework/security/data-governance)