nerdexam
Google

PROFESSIONAL-CLOUD-ARCHITECT · Question #299

To improve governance and security, your organization has structured the Google Cloud environment using folders for different business units. Each business unit folder has subfolders for…

The correct answer is A. At each production folder, apply a hierarchical firewall policy to deny all ingress except for HTTPS. Hierarchical firewall policies applied at the production folders let you centrally enforce “deny all internet ingress by default” while adding a specific allow HTTPS rule for tagged VMs. Because hierarchical firewall policies sit above project-level VPC firewall rules, project…

Submitted by ahmad_uae· Mar 30, 2026Designing for security and compliance

Question

To improve governance and security, your organization has structured the Google Cloud environment using folders for different business units. Each business unit folder has subfolders for development, staging, and production environments, which must comply with internal security controls: - Production workloads must be protected from direct internet ingress by default unless explicitly tagged. - The application must be accessible to customers over HTTPS. You need to design a scalable and enforceable model that blocks internet ingress traffic to the production folders while selectively allowing direct HTTPS traffic to the necessary virtual machines. You must also ensure that individual project teams cannot overwrite these controls once they are implemented for all current and future production projects. What should you do?

Options

  • AAt each production folder, apply a hierarchical firewall policy to deny all ingress except for HTTPS
  • BMandate the application teams to deploy a Terraform module to create VPC firewall rules in each
  • CAt the organization root, apply a hierarchical firewall policy to deny all ingress except for HTTPS
  • DAt each production folder, use an organization policy to block all external IPs and require teams to

How the community answered

(52 responses)
  • A
    46% (24)
  • B
    10% (5)
  • C
    29% (15)
  • D
    15% (8)

Explanation

Hierarchical firewall policies applied at the production folders let you centrally enforce “deny all internet ingress by default” while adding a specific allow HTTPS rule for tagged VMs. Because hierarchical firewall policies sit above project-level VPC firewall rules, project teams cannot override these controls, and any current or future projects created under those production folders automatically inherit the policy. This meets the requirements for governance, security, selective HTTPS access, and scalability.

Topics

#hierarchical firewall policy#folder hierarchy#internet ingress#organization policy

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-ARCHITECT Practice