You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on the folder level…

The correct answer is C. 1. Attach external IP addresses to the VMs in scope. The answer choices in the question appear truncated - only the first step of each multi-step answer is visible. Based on the correct answer being C and the context of the question, here is the conceptual explanation: Why C is correct: The best solution uses a Hierarchical…

Submitted by ngozi_ng· Apr 18, 2026Configuring network security

Question

You control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network "dev-vpc". You want to minimize implementation and maintenance effort. What should you do?

Options

A
1. Leave the network configuration of the VMs in scope unchanged.
B
1. Leave the network configuration of the VMs in scope unchanged.
C
1. Attach external IP addresses to the VMs in scope.
D
1. Attach external IP addresses to the VMs in scope.

How the community answered

(52 responses)

A
17% (9)
B
8% (4)
C
46% (24)
D
29% (15)

Explanation

The answer choices in the question appear truncated - only the first step of each multi-step answer is visible. Based on the correct answer being C and the context of the question, here is the conceptual explanation:

Why C is correct: The best solution uses a Hierarchical Firewall Policy (also called a Network Firewall Policy) applied at the folder level. This allows you to define a single egress deny-all rule with an exception allowing traffic only to 10.58.5.0/24, scoped to the dev-vpc network, and have it automatically inherited by every project within the folder - requiring no per-project or per-VPC configuration.

Why A and B are wrong: Options A and B ("Leave the network configuration of the VMs unchanged") likely pair with per-VPC firewall rules or per-project policies, which must be replicated across every VPC and project individually - increasing implementation and ongoing maintenance burden as the environment grows.

Why D is wrong: Option D ("Attach external IP addresses to the VMs") is the wrong direction entirely - assigning external IPs expands egress paths rather than restricting them, and does not provide the centralized folder-level enforcement the question requires.

Memory tip: Think "folder-level = Hierarchical Firewall Policy." Just as IAM policies inherit downward from organization → folder → project, Hierarchical Firewall Policies enforce network rules top-down - one policy, many projects, minimal maintenance.

Topics

#Network Security#Egress Filtering#Folder-level Enforcement#External IP Addresses

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice