Google Professional Cloud Network Engineer Question 357
Select 3Google Cloud PlatformYour organization has been using Google Cloud firewall rules to control traffic across multiple projects. To improve manageability and scalability, you have decided to migrate to hierarchical firewall policies. Which steps should you take to achieve this migration effectively?
- A
Create hierarchical firewall policies at the organization or folder level to apply to all relevant projects.
- B
Delete all existing VPC-level firewall rules before creating hierarchical firewall policies to avoid conflicts.
- C
Evaluate and prioritize the use of hierarchical firewall policies for rules that need to apply across multiple projects.
- D
Update IAM policies to grant the required permissions for managing hierarchical firewall policies.
- E
Migrate VPC-level firewall rules to hierarchical policies one-by-one to prevent any immediate service interruptions.
Show answer and explanation
Correct answers: A, C, D
Explanation
Migrating from firewall rules to hierarchical firewall policies involves creating policies at the organization or folder level, ensuring proper permissions are set, and prioritizing rules that apply across multiple projects. It is not necessary to delete VPC-level rules immediately, nor should the migration be done one rule at a time without a comprehensive plan.
- A. Correct.
Creating hierarchical firewall policies at the organization or folder level ensures that rules can be applied globally across multiple projects, which is the main benefit of using hierarchical firewall policies.
- B. Incorrect.
It is not necessary to delete existing VPC-level firewall rules immediately, as they can coexist with hierarchical firewall policies during the migration. GCP evaluates hierarchical policies and VPC-level rules in a predictable order.
- C. Correct.
Evaluating and prioritizing the use of hierarchical firewall policies is a key step, as not all firewall rules may need to be migrated. Hierarchical policies are best suited for rules affecting multiple projects.
- D. Correct.
IAM permissions must be updated to allow relevant administrators to create, modify, and manage hierarchical firewall policies. Without proper permissions, the migration and management will fail.
- E. Incorrect.
Migrating VPC-level rules to hierarchical policies one-by-one can cause unnecessary disruption and inefficiency. Hierarchical policies should be planned and implemented holistically.