The correct answer is Stored as deployment configuration artifacts and applied during deployment.

This option aligns with the declarative model because policies are treated as desired state and not as runtime procedures. Storing rules as deployment configuration artifacts lets teams manage them in version control and apply them through the CI CD pipeline so that runtime protections are reproducible and auditable.

Managed through Google Cloud IAM policies is incorrect because IAM controls identity and access permissions and it does not provide a general declarative framework for runtime protection rules. IAM is about who can do what and not about declaring application runtime behavior.

Hard coded into the application source is incorrect because embedding rules in application code creates imperative logic that is hard to change and audit. That approach prevents independent versioning and centralized policy management which are key to declarative practices.

Defined as a sequence of procedural steps that code must execute is incorrect because a procedural sequence is the opposite of declarative design. Declarative policies express the desired end state and leave enforcement to the platform while procedural definitions require explicit step by step execution inside the application.

Full AWS Practitioner Certification Question