You are designing the IAM hierarchy for a new GCP organization. Following Google's best practices for security and manageability, which THREE principles should you apply? (Select THREE)

Assign roles to Google Groups rather than individual users

Apply the principle of least privilege using predefined roles

Use Folders to group projects by department or environment

Grant the 'Owner' role to all senior developers

Use Custom Roles for every single permission to ensure maximum security

Apply all IAM policies directly at the resource level (e.g., individual VMs)