You need to audit the network segmentation for your Google Cloud footprint. You currently operate Production and Non-Production infrastructure-as-a-service (IaaS) environments. All your VM instances…

Question

Options

• AAll VM instances are missing the respective network tags.
• BAll VM instances are residing in the same network subnet.
• CAll VM instances are configured with the same network route.
• DA VPC firewall rule is allowing traffic between source/targets based on the same service account
• EA VPC firewall rule is allowing traffic between source/targets based on the same service account

• A
  4% (1)
• B
  8% (2)
• C
  4% (1)
• D
  62% (16)
• E
  23% (6)

Explanation

The key clue is that all VM instances were deployed without any service account customization, meaning they all use the same default Compute Engine service account. If a VPC firewall rule exists that allows traffic between instances sharing the same service account identity (rather than using network tags), all those VMs can communicate freely - the tag-based rules at priority 1000 are irrelevant because the service-account-based allow rule matches first or operates alongside them. This is a common misconfiguration: a broad allow rule based on service account identity overrides the intended tag-based segmentation. The fix is to remove or tighten the service-account-based firewall rule and ensure tag-based rules are applied correctly.

No community discussion yet for this question.