Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
An enterprise security architect is designing a multi-project network topology in Google Cloud using Shared VPC. The organization requires strict separation of duties, resource isolation, and centralized network governance between the central cloud infrastructure team and individual application development teams.
The design must meet the following requirements:
service-project-a must only be able to deploy Compute Engine virtual machines and internal load balancers into an assigned subnet (subnet-app-prod) in us-central1.subnet-management or subnet-app-dev) and must not have permissions to modify host network security policies.Which IAM role delegation strategy should the architect implement?
roles/compute.networkUser role specifically on the subnet-app-prod resource in the host project, and grant the roles/compute.instanceAdmin.v1 role in service-project-a.Subnet-level IAM delegation in Google Cloud Shared VPC architectures allows administrators to grant granular permissions on individual subnet resources rather than at the overall host project level. By assigning the Compute Network User role (roles/compute.networkUser) directly to specific subnets, organizations establish granular administrative boundaries that adhere to the principle of least privilege.
roles/compute.networkUser exclusively on subnet-app-prod permits developers in service-project-a to attach network interfaces and deploy VM instances or internal load balancers into that specific subnet only.subnet-app-prod rather than the host project, developers have no rights to use subnet-management, subnet-app-dev, or any other shared subnets.roles/compute.instanceAdmin.v1) within service-project-a gives developers full control over workload provisioning inside their own project while denying permissions to modify firewall rules, routes, or VPC structures in the host project.This configuration represents the recommended security baseline for enterprise Shared VPC deployments. It cleanly separates non-network workload administration in service projects from centralized network policy enforcement in the host project.
roles/compute.networkUser role at the host project level, and grant the roles/compute.securityAdmin role in service-project-a.Granting Compute Network User (roles/compute.networkUser) at the host project level grants access to all subnets across all VPCs in that host project. The Compute Security Admin role (roles/compute.securityAdmin) allows principals to create, modify, and delete firewall rules and SSL certificates.
roles/compute.networkUser at the host project level allows the application team to deploy instances into every subnet, directly violating the restriction against using subnet-management or subnet-app-dev.roles/compute.securityAdmin gives application developers authority to create firewall policies, contrary to the requirement for centralized network security control.roles/compute.networkUser grants broad permission to associate resources with any existing or future subnet in the host project.The organization intended for all service project teams to have unrestricted access across all existing and future subnets defined within the host project.
To restrict workload provisioning to specific subnets, roles/compute.networkUser must be bound at the individual subnet resource level, not inherited from the host project level.
roles/compute.admin role in service-project-a and configure VPC Network Peering between service-project-a and the host project.VPC Network Peering connects two separate VPC networks to enable internal RFC 1918 communication across project boundaries without routing traffic through the public internet. The Compute Admin role (roles/compute.admin) grants full control of all Compute Engine resources within a project.
The organization required application teams to have completely autonomous VPC networks with independent administration while maintaining direct private network reachability.
Shared VPC allows instances in service projects to draw IP addresses directly from subnets defined in the host project, providing native centralized governance that VPC Peering cannot match.
roles/compute.networkAdmin role at the host project level, scoped with an IAM condition restricting access to subnet-app-prod.The Compute Network Admin role (roles/compute.networkAdmin) provides administrative control over all networking resources, including the ability to create, modify, and delete VPC networks, subnets, routes, Cloud Routers, and VPN gateways.
roles/compute.networkAdmin violates the requirement that central infrastructure teams maintain exclusive authority over network configurations.roles/compute.networkAdmin do not cleanly prevent administrative modifications to broader network assets, such as global routing tables or shared firewall configurations.The application team was responsible for engineering and managing network infrastructure, including defining subnets, configuring Cloud Routers, and provisioning Cloud Interconnect attachments.
In a Shared VPC model, service project teams should only receive consumer roles (such as roles/compute.networkUser) on specific network resources, never administrative roles over the host network.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated Validated