An enterprise is designing a network security architecture across multiple folders and projects in Google Cloud. The central security team requires the following: Enforce consistent, non-overridable security baselines across all projects at the Organization and Folder levels. Allow specific security policy rules to delegate unhandled traffic evaluation to lower-level policies and individual VPCs. Implement granular micro-segmentation on Compute Engine workloads using centrally governed identity labels that project-level compute administrators cannot tamper with or modify. Record all matched and denied traffic events with connection attributes and rule metadata for centralized security auditing and intrusion analysis. Which strategy should the enterprise implement?

Bind hierarchical firewall policies to the Organization and Folder nodes using secure tags (Resource Manager tags) for target micro-segmentation, configure delegate actions for unhandled rules, and enable Firewall Rule Logging with metadata enabled.: ### What Hierarchical Firewall Policies and Secure Tags Are **Hierarchical firewall policies** allow security administrators to define and enforce consistent firewall rules across the entire resource hierarchy, including at the **Organization** and **Folder** levels. **Secure tags** (Resource Manager tags) are centrally governed key-value pairs managed via Identity and Access Management (**IAM**), allowing network security teams to enforce granular micro-segmentation without exposing tag assignment to local project operators. ### How It Meets the Requirements - **Organization and Folder-level baselines:** Hierarchical firewall policy rules are evaluated before any VPC-level firewall rules. Rules defined at higher levels cannot be bypassed or overridden by project owners. - **Delegation to lower levels:** Hierarchical rules support the `goto_next` (or delegate) evaluation behavior, allowing traffic that does not match a top-level rule to cleanly cascade down to child folder policies and VPC firewall rules. - **Centrally governed micro-segmentation:** Secure tags are bound to Google Cloud resources through Resource Manager permissions (`roles/resourcemanager.tagUser`), preventing unauthorized VM instance administrators from altering their security classification. - **Firewall Rule Logging and metadata capture:** Enabling **Firewall Rule Logging** with metadata capture logs connection states, 5-tuple network details, rule evaluation actions (ALLOW/DENY), and associated VM information directly to **Cloud Logging**. ### Key Advantages and Capabilities - **Implicit and explicit inheritance:** Policies seamlessly propagate down the hierarchy while supporting granular regional or environmental delegation. - **Tamper-proof tagging:** Unlike legacy network tags, secure tags are integrated with Cloud IAM and cannot be modified by local Compute Instance Admins. - **Centralized audit trail:** Integrates natively with aggregated log sinks to route firewall evaluation data to centralized SIEM or BigQuery repositories. - **Defense-in-depth:** Combines macro-perimeter ingress/egress filtering with fine-grained host micro-segmentation. ### Why This Is Optimal This architecture guarantees strict boundary segmentation and centralized control, while giving security operations teams rich forensic telemetry without placing operational burdens on local application teams.

Hierarchical Firewalls Secure Tags Logging | Professional Cloud Security Engineer

Hierarchical Firewalls Secure Tags Logging

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing a network security architecture across multiple folders and projects in Google Cloud. The central security team requires the following:

Enforce consistent, non-overridable security baselines across all projects at the Organization and Folder levels.
Allow specific security policy rules to delegate unhandled traffic evaluation to lower-level policies and individual VPCs.
Implement granular micro-segmentation on Compute Engine workloads using centrally governed identity labels that project-level compute administrators cannot tamper with or modify.
Record all matched and denied traffic events with connection attributes and rule metadata for centralized security auditing and intrusion analysis.

Which strategy should the enterprise implement?

Deploy hierarchical firewall policies using standard Compute Engine network tags as rule targets, enforce mandatory Terminate actions on all rules, and configure Cloud NAT logging for egress intrusion analysis.

Create project-level firewall rules targeting Google service accounts, deploy Packet Mirroring across all subnets, and export packet captures to Cloud Logging using aggregated log sinks.

Bind hierarchical firewall policies to the Organization and Folder nodes using secure tags (Resource Manager tags) for target micro-segmentation, configure delegate actions for unhandled rules, and enable Firewall Rule Logging with metadata enabled.

Configure standard VPC firewall rules in each project's VPC, apply Compute Engine network tags directly to VM instances for micro-segmentation, and rely on subnet VPC Flow Logs for security auditing.

Professional Cloud Security Engineer

Hierarchical Firewalls Secure Tags Logging

Related questions