The correct options are Groups and individual user accounts can be assigned to project roles, Project roles are referenced by permission schemes to govern project access, and Project administrators can change a role's membership inside a specific project.

The statement Groups and individual user accounts can be assigned to project roles is correct because project roles are intended to contain both user accounts and groups so that permissions can be granted at the role level rather than to each user individually. This lets administrators manage access more efficiently by assigning roles rather than repeating assignments for each person.

The statement Project roles are referenced by permission schemes to govern project access is correct because permission schemes assign permissions to roles and not to projects directly. Permission schemes map actions to roles so that changing a role membership changes who has the associated permissions without altering the scheme itself.

The statement Project administrators can change a role's membership inside a specific project is correct because project administrators typically have the ability to add or remove users and groups from roles only within the scope of that project. This allows per project adjustments without affecting other projects that use the same role name.

The statement Project administrators can alter the default members that are applied to every newly created project role is incorrect. Default members for project roles are part of the global configuration and are managed at the system or site administration level rather than by individual project administrators. Allowing project admins to change global defaults would affect every new project and so that capability is reserved for higher level administrators.

Full AWS Practitioner Certification Question