You manage IAM policies for your organization ' s Google Cloud project.

The correct answer is C because the requirement is strict least privilege. The operations team only needs three actions: start, stop, and reset existing Compute Engine VM instances. A custom IAM role is the correct mechanism when predefined roles are too broad. Google Cloud custom roles are designed so administrators can include only the permissions required for a specific operational task, and the role definition explicitly lists included permissions. Viewer cannot start, stop, or reset instances, so B is not functional. Instance Admin is too broad because it includes administrative permissions beyond the stated task. IAM Conditions cannot simply subtract a single permission from an overprivileged predefined role.