Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your organization is establishing a centralized network topology in Google Cloud to support multiple autonomous application teams while enforcing strict security and environment boundaries. You have designated a central host project (net-host-prod) containing a Shared VPC network with two distinct subnets: team-a-subnet and team-b-subnet.
You have created two dedicated service projects: service-team-a for Team A and service-team-b for Team B. You need to configure IAM roles and subnet access to satisfy the following requirements:
StudyCerts
StudyCertsteam-a-subnet.team-b-subnet.How should you configure the IAM role assignments across the host and service projects?
Grant the central Network Engineering team the Compute Network Admin (roles/compute.networkAdmin) role on the host project. In the host project, grant Team A principals and the service-team-a Google APIs service account the Compute Network User (roles/compute.networkUser) role specifically on team-a-subnet, and grant Team B principals and the service-team-b Google APIs service account roles/compute.networkUser specifically on team-b-subnet. Grant each team Instance Admin (roles/compute.instanceAdmin.v1) within their respective service project.
Grant the central Network Engineering team the Compute Network Admin (roles/compute.networkAdmin) role on the host project. In the host project, grant both Team A and Team B principals the Compute Network User (roles/compute.networkUser) role at the host project level. Grant each team Instance Admin (roles/compute.instanceAdmin.v1) within their respective service project.
Grant the central Network Engineering team the Compute Network Admin (roles/compute.networkAdmin) role on the host project. In the host project, create a custom IAM role containing only compute.subnetworks.use and grant it to both teams at the host project level. In each service project, grant the Compute Engine default service account the Owner (roles/owner) role.
Grant the central Network Engineering team the Compute Security Admin (roles/compute.securityAdmin) role on the host project. In each service project, grant Team A and Team B the Compute Network Admin (roles/compute.networkAdmin) role. Attach the service projects to the host project using VPC Network Peering.
Grant the central Network Engineering team the Compute Network Admin (roles/compute.networkAdmin) role on the host project. In the host project, grant Team A principals and the service-team-a Google APIs service account the Compute Network User (roles/compute.networkUser) role specifically on team-a-subnet, and grant Team B principals and the service-team-b Google APIs service account roles/compute.networkUser specifically on team-b-subnet. Grant each team Instance Admin (roles/compute.instanceAdmin.v1) within their respective service project.
This architecture establishes a Shared VPC design where a single central host project manages underlying network topology and routing, while separate service projects host workloads managed by decentralized application teams. Subnet-level IAM access binding provides granular network segregation across service projects.
roles/compute.networkAdmin exclusively to the central team on the host project (net-host-prod) guarantees that only network engineers can modify network routes, subnets, and global configurations.roles/compute.networkUser) role directly to individual subnets (team-a-subnet and team-b-subnet) ensures that each team can only attach network interfaces to their authorized IP range. Team A cannot provision resources into Team B's subnet.roles/compute.instanceAdmin.v1 inside the respective service projects allows developers to manage virtual machines and templates. Binding roles/compute.networkUser on the subnet to the service project's Google APIs service account (SERVICE_PROJECT_NUM@cloudservices.gserviceaccount.com) is a mandatory requirement for automated instance provisioning in Managed Instance Groups (MIGs).Subnet-level IAM role delegation is the Google-recommended best practice for multi-tenant and multi-environment Shared VPC deployments. It separates administrative duties while strictly constraining resource placement across service projects.
Grant the central Network Engineering team the Compute Network Admin (roles/compute.networkAdmin) role on the host project. In the host project, grant both Team A and Team B principals the Compute Network User (roles/compute.networkUser) role at the host project level. Grant each team Instance Admin (roles/compute.instanceAdmin.v1) within their respective service project.
Grant the central Network Engineering team the Compute Network Admin (roles/compute.networkAdmin) role on the host project. In the host project, create a custom IAM role containing only compute.subnetworks.use and grant it to both teams at the host project level. In each service project, grant the Compute Engine default service account the Owner (roles/owner) role.
Grant the central Network Engineering team the Compute Security Admin (roles/compute.securityAdmin) role on the host project. In each service project, grant Team A and Team B the Compute Network Admin (roles/compute.networkAdmin) role. Attach the service projects to the host project using VPC Network Peering.