How can these requirements be met, assuming the organization-wide default for projects is set to private?

Universal container manages internal projects by department using a custom object called projects. Only employees in the project’s respective department should have view access to all of the department’s project records. If an employee changes job roles and moves to another department, the employee should no longer have access to the projects within their former department .

How can these requirements be met, assuming the organization-wide default for projects is set to private? Choose 2 answers
A . Create a criteria based sharing rule using the projects department that grants access to users by permission set.
B . Create a criteria based sharing rule using the projects department that grants access to users by roles.
C . Create a criteria based sharing rule using the projects department that grants access to users by public groups.
D . Create a criteria based sharing rule using the projects department that grants access to users by profiles

Answer: B,C