An enterprise security architect is designing a multi-project network topology in Google Cloud using Shared VPC. The organization requires strict separation of duties, resource isolation, and centralized network governance between the central cloud infrastructure team and individual application development teams. The design must meet the following requirements: Central infrastructure administrators must retain exclusive control over VPC networks, IP address allocations, routes, and firewall rules within the host project. Application teams managing service-project-a must only be able to deploy Compute Engine virtual machines and internal load balancers into an assigned subnet (subnet-app-prod) in us-central1. Application developers must be prevented from provisioning workloads into any other subnets (such as subnet-management or subnet-app-dev) and must not have permissions to modify host network security policies. Which IAM role delegation strategy should the architect implement?

Grant the application team the `roles/compute.networkUser` role specifically on the `subnet-app-prod` resource in the host project, and grant the `roles/compute.instanceAdmin.v1` role in `service-project-a`.: ### What Subnet-Level IAM Delegation Is **Subnet-level IAM delegation** in Google Cloud Shared VPC architectures allows administrators to grant granular permissions on individual subnet resources rather than at the overall host project level. By assigning the **Compute Network User** role (`roles/compute.networkUser`) directly to specific subnets, organizations establish granular administrative boundaries that adhere to the principle of least privilege. ### How It Meets the Requirements - **Subnet-specific deployment**: Assigning `roles/compute.networkUser` exclusively on `subnet-app-prod` permits developers in `service-project-a` to attach network interfaces and deploy VM instances or internal load balancers into that specific subnet only. - **Preventing unauthorized subnet access**: Because the role is bound to `subnet-app-prod` rather than the host project, developers have no rights to use `subnet-management`, `subnet-app-dev`, or any other shared subnets. - **Separation of administrative duties**: Granting **Compute Instance Admin (v1)** (`roles/compute.instanceAdmin.v1`) within `service-project-a` gives developers full control over workload provisioning inside their own project while denying permissions to modify firewall rules, routes, or VPC structures in the host project. ### Key Advantages and Capabilities - **Precise access control**: Prevents accidental or malicious workload provisioning in sensitive network segments. - **Centralized security governance**: Network and Security Admins manage all routing, firewall configurations, and IP assignments centrally in the host project. - **Environment isolation**: Guarantees that separate teams operating in distinct service projects cannot interfere with each other's network allocations. - **Independent workload lifecycle**: Service project administrators can manage instance configurations, persistent disks, and scaling without requiring elevated networking permissions. ### Why This Is Optimal This configuration represents the recommended security baseline for enterprise Shared VPC deployments. It cleanly separates non-network workload administration in service projects from centralized network policy enforcement in the host project.

Shared Vpc Subnet Level Iam Delegation | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise uses a hub-and-spoke network topology on Google Cloud. The central hub-vpc is connected to multiple departmental spoke VPCs via VPC Network Peering, with custom route exchange enabled to share internal routes across networks. A security engineer is deploying a private VPC-native Google Kubernetes Engine (GKE) cluster in spoke-vpc-a. The cluster deployment fails during creation with an IP address conflict error, even though the selected /28 control plane IP range does not overlap with any primary or secondary subnet ranges locally configured inside spoke-vpc-a. What is the root cause of this deployment failure, and how should the engineer resolve it?

Designing and configuring private connectivity between VPC networks and Google Cloud projects (Shared VPC, VPC peering, and Private Google Access for on-premises hosts).

AdvancedProfessional Cloud Security Engineer

An enterprise maintains hybrid workloads in an on-premises data center connected to a Google Cloud Virtual Private Cloud (VPC) via Dedicated Interconnect. The organization enforces a VPC Service Controls (VPC-SC) perimeter around its cloud projects to prevent data exfiltration. The security team mandates that on-premises servers must access Google APIs privately through the Interconnect link without traversing the public internet, and all API traffic must be strictly governed by the VPC Service Controls perimeter. Which combination of routing and DNS configurations should you implement to satisfy these security requirements?

AdvancedProfessional Cloud Security Engineer

An enterprise hosts an e-commerce platform behind an external Application Load Balancer with an attached Google Cloud Armor security policy. The security engineering team has the following access and threat protection requirements for a backend service: Allow corporate administrators connecting from the CIDR range 198.51.100.0/24 to access administrative endpoints matching request.path.matches('/admin/.') without being blocked by general WAF inspection. Block all other external clients attempting to access any endpoints under /admin/.. Inspect all non-admin public traffic against preconfigured WAF rules for SQL injection (sqli-v33-stable) and Cross-Site Scripting (xss-v33-stable), denying matched exploits. Allow all remaining legitimate customer traffic. How should the Cloud Armor security policy rules and priorities be configured to enforce these requirements correctly?

AdvancedProfessional Cloud Security Engineer

A financial enterprise requires a secure, high-bandwidth connection between its on-premises data center and a Google Cloud VPC network. Compliance regulations mandate that all data in transit must be encrypted using IPsec tunnels, and the architecture must guarantee a 99.99% availability Service Level Agreement (SLA) with automated dynamic route propagation via BGP. Which configuration should the network security engineer implement to satisfy these requirements?

AdvancedProfessional Cloud Security Engineer

An enterprise is designing a secure identity and access architecture across its hybrid environment and Google Cloud Platform (GCP). The security team has defined two core integration requirements: Requirement 1: Corporate employees must authenticate via browser-based Single Sign-On (SSO) into the Google Cloud Console using the organization's existing on-premises enterprise Identity Provider (IdP). Requirement 2: A custom customer-facing web application needs to securely call Google Cloud REST APIs (such as BigQuery and Cloud Storage) on behalf of authenticated users with limited, scoped access, without ever storing or handling the users' enterprise passwords. Which protocol design aligns with Google Cloud security best practices to satisfy both requirements?

FundamentalAssociate Data Practitioner

A data team is expanding their data warehouse capabilities by integrating external machine learning capabilities into BigQuery. They have set up a BigQuery Cloud resource connection named my_connection in the us multi-region and granted the associated service account the required Vertex AI permissions. Which Data Definition Language (DDL) statement should the team run in BigQuery to register a remote model that connects through this external connection?

Professional Cloud Security Engineer

Shared Vpc Subnet Level Iam Delegation

Related questions