You have successfully created a development environment in a project for an application. This application uses Compute Engine and Cloud SQL. Now, you need to create a production environment for this application. The security team has forbidden the existence of network routes between these 2 environments, and asks you to follow Google-recommended practices. What should you do?

The Google-recommended best practice for isolating environments (e.g., development, production) is to use separate projects. Creating a new project for the production environment provides the strongest boundary for security, IAM policies, billing, and quotas. Each new project, by default, contains its own independent Virtual Private Cloud (VPC) network. This default configuration ensures there are no network routes between the new production project and the existing development project, directly satisfying the security team's requirement for complete network isolation. This approach is the most secure, manageable, and scalable solution.

B. Placing production resources in a new subnet within the same VPC as development directly violates the "no network routes" requirement, as all subnets in a VPC are routable to each other by default.
C. Using a Shared VPC is designed to connect projects to a single, shared network. This is the opposite of the required network isolation and would create routes between the environments.
D. Reusing another division's project is poor practice. It creates security risks, potential resource conflicts (e.g., quotas), and management complexity, violating the principle of least privilege and clear ownership.

1. Google Cloud Documentation

Resource Manager

Resource hierarchy: "The project forms the basis for creating

enabling

and using all Google Cloud services... Any resources created inside a project remain within the project boundary." This establishes the project as the fundamental unit of isolation.

2. Google Cloud Architecture Center

Google Cloud security foundations guide

Section 3.1

Define a resource hierarchy: "We recommend that you separate your production and non-production environments. For example

you can create a production folder and a non-production folder in your organization node... This separation helps you to isolate your production environment from your lower environments." This explicitly recommends separating environments at the project or folder level.

3. Google Cloud Documentation

Virtual Private Cloud (VPC)

VPC networks overview: "VPC networks are global resources... A project can contain multiple VPC networks. Unless you create an organizational policy that constrains it

new projects start with a default network." This confirms that new projects get their own isolated networks by default.

4. Google Cloud Documentation

Shared VPC

Shared VPC overview: "Shared VPC allows an organization to connect resources from multiple projects to a common Virtual Private Cloud (VPC) network so that they can communicate with each other securely and efficiently using internal IPs from that network." This highlights that Shared VPC is for connectivity

not isolation

making it unsuitable for this scenario.