You are creating a custom IAM role because predefined roles provide too much access. Which TWO statements are true regarding custom IAM roles? (Select TWO)

Custom roles can only be created at the project or organization level, not the folder level.

Custom roles automatically inherit new permissions when Google updates a service.

You must manually maintain custom roles if Google adds new permissions to services.

Custom roles can include permissions from any GCP service without restriction.

Custom roles are recommended over predefined roles for all use cases.