Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise is designing a network security architecture across multiple folders and projects in Google Cloud. The central security team requires the following:
Which strategy should the enterprise implement?
Hierarchical firewall policies allow security administrators to define and enforce consistent firewall rules across the entire resource hierarchy, including at the Organization and Folder levels. Secure tags (Resource Manager tags) are centrally governed key-value pairs managed via Identity and Access Management (IAM), allowing network security teams to enforce granular micro-segmentation without exposing tag assignment to local project operators.
goto_next (or delegate) evaluation behavior, allowing traffic that does not match a top-level rule to cleanly cascade down to child folder policies and VPC firewall rules.roles/resourcemanager.tagUser), preventing unauthorized VM instance administrators from altering their security classification.This architecture guarantees strict boundary segmentation and centralized control, while giving security operations teams rich forensic telemetry without placing operational burdens on local application teams.
Targeting firewall rules with service accounts provides identity-based filtering at the VPC level, while Packet Mirroring copies raw ingress and egress packet payloads from VM instances and forwards them to an internal collector load balancer for deep packet inspection.
The primary requirement was full deep packet payload inspection (DPI) using a third-party Network Threat Detection system rather than centralized firewall policy enforcement and rule logging.
This option attempts to attach legacy Compute Engine network tags directly to hierarchical firewall policies, enforces strict rule termination, and uses Cloud NAT logging to inspect outbound traffic.
goto_next) prevents lower-level folder policies and local VPC firewall rules from evaluating application-specific legitimate traffic.The enterprise only needed to monitor public internet egress connections through a managed gateway and did not require cross-project hierarchical policy evaluation or internal traffic micro-segmentation.
VPC firewall rules are defined locally inside a specific Virtual Private Cloud (VPC) network, and network tags are free-form strings assigned directly to VM instances by Compute Engine administrators.
roles/compute.instanceAdmin role in the project. Developers or compromised accounts can modify their own VM tags to bypass network restrictions.The workload existed entirely within a single, isolated VPC managed by a single administrative team with no requirement for organizational hierarchy inheritance or tamper-resistant tag governance.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated