Google Professional Cloud Network Engineer Question 100
Single answerGoogle Cloud PlatformYour organization has a Google Cloud environment with multiple VPCs across different projects. You are tasked with implementing a firewall strategy to ensure consistent control of ingress traffic across all projects and VPCs, while allowing project teams the flexibility to manage their own specific firewall rules. Which solution would best meet these requirements?
- A
Use VPC-level firewall rules in each project to manage ingress traffic.
- B
Deploy hierarchical firewall rules and set them at the organization or folder level.
- C
Implement Cloud Next Generation Firewall to centrally manage all firewall rules for all VPCs.
- D
Use a combination of VPC firewall rules and Cloud Armor to control ingress traffic.
Show answer and explanation
Correct answer: B
Explanation
Hierarchical firewall rules provide a centralized solution for defining ingress and egress traffic policies at the organization or folder level in Google Cloud. This ensures consistent application of security policies across all projects and VPCs, while allowing individual project teams the flexibility to define additional VPC-level rules as needed.
- A. Incorrect.
VPC-level firewall rules are effective for controlling traffic within a specific VPC but do not provide a consistent, centralized mechanism to manage ingress traffic across multiple projects or VPCs.
- B. Correct.
Hierarchical firewall rules are designed for centralized management of firewall policies at the organization or folder level. This allows for consistent control of ingress traffic across all projects, while still enabling project teams to define additional rules at the VPC level if needed.
- C. Incorrect.
Cloud Next Generation Firewall is primarily used for advanced security features such as packet inspection and threat detection. It is not specifically designed for managing centralized ingress traffic rules across multiple projects.
- D. Incorrect.
Cloud Armor is a web application firewall service and is intended for protecting applications from web-based attacks, not for managing ingress traffic at the VPC or organizational level.