Google Professional Cloud Security Engineer Question 241
Select 3Google Cloud PlatformYour organization has multiple projects in Google Cloud and wants to centralize network management for better security control. You have been asked to configure a Shared VPC with the following requirements:
- A central host project should manage the VPC network.
- Service projects should connect to the host project and use the shared VPC.
- Firewall rules should ensure that only internal communication between service projects is allowed while blocking external access.
What steps should you take to meet these requirements?
- A
Configure a Shared VPC by designating a host project and attaching service projects to it.
- B
Create firewall rules in the host project to allow internal traffic between service projects and deny external access.
- C
Set up VPC Peering between the host project and the service projects to enable network communication.
- D
Enable IAM roles such as 'Shared VPC Admin' for administrators to manage the Shared VPC.
- E
Create separate VPC networks in each service project and connect them using Cloud VPN.
Show answer and explanation
Correct answers: A, B, D
Explanation
To configure a Shared VPC and meet the organization's requirements, you need to designate a host project, attach service projects, and set up appropriate firewall rules in the host project. IAM roles like 'Shared VPC Admin' are also necessary for administrators to manage the Shared VPC effectively. VPC Peering and Cloud VPN are not required in this scenario since the Shared VPC already provides centralized network communication and security management.
- A. Correct.
Correct: Configuring a Shared VPC with a designated host project is essential to centralize network management and allow service projects to use the shared resources.
- B. Correct.
Correct: Firewall rules must be created in the host project to enforce security requirements, such as allowing internal communication and blocking external access.
- C. Incorrect.
Incorrect: VPC Peering is not required for Shared VPC configurations. The Shared VPC already enables network communication between the host and service projects without peering.
- D. Correct.
Correct: Assigning IAM roles like 'Shared VPC Admin' is necessary for administrators to manage the Shared VPC and its associated resources.
- E. Incorrect.
Incorrect: Creating separate VPCs and using Cloud VPN is not aligned with the Shared VPC model. Shared VPC consolidates network management into a single VPC in the host project.