Google Professional Cloud Network Engineer Question 779
Single answerGoogle Cloud PlatformYour organization is running a multi-project architecture in Google Cloud. You are tasked with creating a firewall rule in one project (Project A) to allow traffic from VM instances in another project (Project B). Both projects are part of the same organization, and you want to ensure that the firewall rule applies only to Project A without affecting other projects. What is the best way to achieve this?
- A
Create a VPC network peering between Project A and Project B, then apply the firewall rule to the shared network.
- B
Use network tags to identify the VM instances in Project A and apply the firewall rule scoped to those tags.
- C
Use service accounts to identify and allow traffic from VM instances in Project B to Project A.
- D
Apply the firewall rule at the organization level, then use a priority value to restrict its effect to Project A.
Show answer and explanation
Correct answer: B
Explanation
To ensure that a firewall rule applies only to resources in a specific project (Project A) without affecting other projects, the best approach is to use network tags. Network tags can be assigned to VM instances in Project A, and the firewall rule can be scoped to those tags. This ensures that the rule applies only within the scope of Project A's VPC network without impacting other projects or resources in the organization.
- A. Incorrect.
This option is incorrect because VPC network peering allows communication between networks but does not inherently address firewall rules scoped to a specific project.
- B. Correct.
This is the correct answer. Using network tags allows you to apply firewall rules selectively to specific resources in a project. The scope of the firewall rule will remain within the project where it is created.
- C. Incorrect.
This option is partially correct but does not address how to scope the firewall rule to Project A. Service accounts are used for identity and access control, not for scoping firewall rules.
- D. Incorrect.
This option is incorrect because organization-level firewall rules affect all projects in the organization unless additional scoping mechanisms, like target tags or service accounts, are used. Even then, this approach is not recommended for project-specific rules.