CLOUD-SECURITY-ENGINEER practice question 4 of 35

Your team needs to configure their Google Cloud Platform (GCP) environment so they can centralize the control over networking resources like firewall…

Your team needs to configure their Google Cloud Platform (GCP) environment so they can centralize the control over networking resources like firewall rules, subnets, and routes. They also have an on- premises environment where resources need access back to the GCP resources through a private VPN connection. The networking resources will need to be controlled by the network security team. Which type of networking design should your team use to meet these requirements?

Answer options

A: Shared VPC Network with a host project and service projects Correct answer

B: Grant Compute Admin role to the networking team for each engineering project

C: VPC peering between all engineering projects using a hub and spoke model

D: Cloud VPN Gateway between all engineering projects using a hub and spoke model

Correct Answer:

A. Shared VPC Network with a host project and service projects

Explanation

Shared VPC is the recommended Google Cloud design for centralizing network administration. It allows an organization to connect resources from multiple projects to a common Virtual Private Cloud (VPC) network. A central "host project" owns the shared network resources (VPC, subnets, firewalls, VPNs), and "service projects" use those resources. This model enables the network security team to manage the network centrally in the host project while delegating project administration to other teams in their respective service projects. This directly meets the requirements for centralized control and connectivity to on-premises environments.

Why Incorrect

B. This approach is decentralized, granting broad permissions in each project, which is the opposite of the requirement for centralized control.
C. VPC peering connects networks but does not centralize the management of firewall rules or subnets; each project would still manage its own network resources.
D. A Cloud VPN Gateway is a component for connectivity, not a design pattern for centralizing administrative control over all networking resources.

References

1. Google Cloud Documentation, "Shared VPC overview". "Shared VPC allows an organization to connect resources from multiple projects to a common Virtual Private Cloud (VPC) network so that they can communicate with each other securely and efficiently using internal IPs from that network... You designate a project as a host project and attach one or more other service projects to it."

2. Google Cloud Documentation, "Shared VPC". "With Shared VPC, a host project owns the networks and subnets. A central network administrator for the host project controls the network. Other projects, called service projects, can be granted permission to use the host project's networks."

3. Google Cloud Architecture Framework, "Network design and security". Section: "Centralized vs. distributed network functions". This section discusses the benefits of centralized models like Shared VPC for consistent policy enforcement.

Keep practicing

Take the free CLOUD-SECURITY-ENGINEER practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test