Shared Vpc Hierarchical Firewall Policy Inheritance | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Shared Vpc Hierarchical Firewall Policy Inheritance

Section: Security controls (e.g., auditing, VPC Service Controls, context aware access, organization policy, and hierarchical firewall policy)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organizes its Google Cloud resource hierarchy into distinct folders for network infrastructure and business workloads. The Shared VPC host project resides in the Core-Networking folder, while multiple service projects containing Compute Engine virtual machines (VMs) reside in the App-Workloads folder.

The central security team applies a hierarchical firewall policy to the Core-Networking folder that denies ingress TCP traffic on port 22. To allow remote access, a development team attaches another hierarchical firewall policy directly to the App-Workloads folder with a high-priority rule allowing ingress TCP traffic on port 22. However, SSH traffic to the VMs connected to the Shared VPC subnets remains blocked.

Why is the ingress traffic on TCP port 22 still blocked on these VM instances?

Service project VM instances only evaluate local VPC firewall rules and ignore all organization or folder-level hierarchical firewall policies.

Hierarchical firewall policies assigned at a parent folder level permanently override all rules defined on any child folders regardless of priority.

In a Shared VPC deployment, VM network interfaces are governed by the hierarchical firewall policies of the host project hierarchy rather than the service project hierarchy.

The hierarchical firewall policy applied to the App-Workloads folder requires an Organization Policy override to take effect on Compute Engine instances.

Professional Cloud Architect

Shared Vpc Hierarchical Firewall Policy Inheritance

Related questions