Exam Associate Cloud Engineer topic 1 question 220 discussion

Its D. "The domain restriction constraint is not retroactive. Once a domain restriction is set, this limitation will apply to IAM policy changes made from that point forward, and not to any previous changes.". Link: https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains

Organization policies are not retroactive. If you need to force a change to your resource hierarchy that would violate an enforced constraint, you can disable the organization policy, make the change, and then enable the organization policy again.

joao_01 provided the appropriate answer, take it or leave it.

D seems to be most appropriate. You can use organization policy constraint to limit the identities by domain. Once the organization policy is set, you can remove the leftover users that mismatched the conditions. https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains

https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints This list constraint defines the set of domains that email addresses added to Essential Contacts can have. By default, email addresses with any domain can be added to Essential Contacts. The allowed/denied list must specify one or more domains of the form @example.com. If this constraint is active and configured with allowed values, only email addresses with a suffix matching one of the entries from the list of allowed domains can be added in Essential Contacts. This constraint has no effect on updating or removing existing contacts. constraints/essentialcontacts.allowedContactDomains

In order to define an organization policy, you choose a constraint, which is a particular type of restriction

https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints - Domain restricted sharing If this constraint is active, only principals that belong to the allowed customer IDs can be added to IAM policies. It doesn't specifically say, but I think it doesn't get rid of existing principals.

Should be D. Organization policy does not remove users automatically.