Google Cloud Professional Cloud Network Engineer — Question 125

Your company has defined a resource hierarchy that includes a parent folder with subfolders for each department. Each department defines their respective project and VPC in the assigned folder and has the appropriate permissions to create Google Cloud firewall rules. The VPCs should not allow traffic to flow between them. You need to block all traffic from any source, including other VPCs, and delegate only the intra-VPC firewall rules to the respective departments. What should you do?

Answer options

• A. Create a VPC firewall rule in each VPC to block traffic from any source, with priority 0.
• B. Create a VPC firewall rule in each VPC to block traffic from any source, with priority 1000.
• C. Create two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to allow, and another lower-priority rule that blocks traffic from any other source.
• D. Create two hierarchical firewall policies per department's folder with two rules in each: a high-priority rule that matches traffic from the private CIDRs assigned to the respective VPC and sets the action to goto_next, and another lower-priority rule that blocks traffic from any other source.

Correct answer: D

Explanation

The correct answer is D because it allows for the management of intra-VPC traffic through the high-priority rule while appropriately blocking any external traffic with the lower-priority rule. Options A and B incorrectly focus on blocking all traffic without providing the necessary intra-VPC exception, and option C fails to utilize the 'goto_next' action, which is essential for allowing specific traffic within the established hierarchy.