You need to create a VPC that enables your security team to control network resources such as firewall rules. How should you configure the network to allow for separation of duties for network…

Setting up multiple VPC networks with multi-NIC virtual appliances increases complexity and operational overhead, and doesn't inherently provide a clean separation of duties for network management across projects as effectively as Shared VPC.

VPC Network Peering allows connecting separate VPC networks, but it doesn't centralize network control under a single security team for resources deployed in different projects in the same way Shared VPC does.

While assigning the Compute Network Admin role to the security team in a single project's VPC gives them control, it doesn't address the "separation of duties" across multiple development teams or projects that might need to use the network without managing its core configuration.

Shared VPC (also known as XPN) is designed for this exact scenario. A host project contains the shared VPC network and is managed by a network administrator (e.g., the security team) who can define and enforce network policies like firewall rules. Service projects, owned by other teams, can then attach to this host project and provision resources (e.g., Compute Engine instances) into the shared network, allowing the security team to maintain central control over networking.