nerdexam
Google

PROFESSIONAL-CLOUD-NETWORK-ENGINEER · Question #162

You are responsible for configuring firewall policies for your company in Google Cloud. Your security team has a strict set of requirements that must be met to configure firewall rules. - Always…

The correct answer is A. Configure a hierarchical firewall policy to the organization node to allow TCP port 22 for your. To enforce organization-wide SSH access rules from a corporate IP that cannot be bypassed by any other VPC firewall rules across multiple projects and VPCs, a hierarchical firewall policy must be configured at the organization node.

Submitted by yasin.bd· Apr 18, 2026Implementing network security

Question

You are responsible for configuring firewall policies for your company in Google Cloud. Your security team has a strict set of requirements that must be met to configure firewall rules. - Always allow Secure Shell (SSH) from your corporate IP address. - Restrict SSH access from all other IP addresses. There are multiple projects and VPCs in your Google Cloud organization. You need to ensure that other VPC firewall rules cannot bypass the security team's requirements. What should you do?

Options

  • AConfigure a hierarchical firewall policy to the organization node to allow TCP port 22 for your
  • BConfigure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 0.
  • CConfigure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 1.
  • DConfigure a hierarchical firewall policy to the organization node to allow TCP port 22 for your

How the community answered

(46 responses)
  • A
    78% (36)
  • B
    13% (6)
  • C
    7% (3)
  • D
    2% (1)

Why each option

To enforce organization-wide SSH access rules from a corporate IP that cannot be bypassed by any other VPC firewall rules across multiple projects and VPCs, a hierarchical firewall policy must be configured at the organization node.

AConfigure a hierarchical firewall policy to the organization node to allow TCP port 22 for yourCorrect

Hierarchical firewall policies, applied at the organization node, are evaluated before any VPC firewall rules and take precedence, ensuring that the defined SSH access requirements (allow from corporate IP, deny from others) cannot be bypassed by rules configured in individual projects or VPCs.

BConfigure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 0.

A VPC firewall rule, even with priority 0, only applies within its specific VPC and can be overridden or bypassed by other VPC rules or higher-level hierarchical firewall policies, failing to meet the "cannot bypass" requirement across multiple VPCs and projects.

CConfigure a VPC firewall rule to allow TCP port 22 for your corporate IP address with priority 1.

A VPC firewall rule with priority 1 is similar to priority 0 but has lower precedence, making it even less suitable for an organization-wide, non-bypassable security requirement.

DConfigure a hierarchical firewall policy to the organization node to allow TCP port 22 for your

This option is identical to option A and is therefore technically correct, but A is specifically marked as the correct answer.

Concept tested: Hierarchical firewall policies precedence and scope

Source: https://cloud.google.com/firewall/docs/hierarchical-firewall-policies

Topics

#Hierarchical Firewall Policy#Organization Policy#Firewall Rules Precedence#Network Security Enforcement

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice