Google Professional Cloud Network Engineer Question 99
Single answerGoogle Cloud PlatformYour organization has a multi-tier application deployed in Google Cloud using multiple VPCs for different environments (e.g., production, staging, and development). You need to ensure consistent and centralized firewall rule enforcement across all environments while also allowing specific teams to manage their own VPC-level firewall rules independently. Which strategy should you implement?
- A
Use VPC firewall rules only and delegate rule creation to individual teams for their respective VPCs.
- B
Deploy Cloud Next Generation Firewall policies to centrally enforce rules across all VPCs.
- C
Implement hierarchical firewall rules for global policy enforcement and allow teams to define additional VPC-level rules as needed.
- D
Set up shared VPCs for all environments and manage all firewall rules at the host project level.
Show answer and explanation
Correct answer: C
Explanation
Hierarchical firewall rules are the best choice for centralizing security policies across all environments while allowing flexibility for individual teams to manage their own VPC-level rules. They operate at the organization or folder level, ensuring consistent enforcement of critical rules across multiple VPCs, which is essential for a multi-tier, multi-environment deployment.
- A. Incorrect.
Using only VPC firewall rules would not provide centralized control, as each team would manage their own rules independently, leading to potential inconsistencies and misconfigurations.
- B. Incorrect.
While Cloud Next Generation Firewall provides advanced security features, it is designed for application-level policies and traffic inspection rather than centralized, hierarchical enforcement of network-level rules across VPCs.
- C. Correct.
Hierarchical firewall rules allow centralized enforcement of security policies at the organization or folder level, ensuring consistency across multiple VPCs, while still permitting teams to define VPC-level firewall rules for their own specific needs.
- D. Incorrect.
Shared VPCs centralize network administration within a host project but do not inherently provide hierarchical rule enforcement across multiple VPCs or environments.