Your organization utilizes Cloud Run services within multiple projects underneath the non- production folder which requires primarily internal communication. Some services need external access to…

Question

Options

• AImplement a global-level allowlist rule for the necessary FQDNs within a hierarchical firewall
• BCreate a folder-level deny-all rule for outbound traffic within a hierarchical firewall policy. Define
• CCreate a project-level deny-all rule within a hierarchical structure and apply it broadly. Override
• DConfigure Cloud NAT with IP-based filtering to permit outbound traffic only to the allowlist d

• A
  5% (2)
• B
  83% (33)
• C
  3% (1)
• D
  10% (4)

Explanation

Hierarchical firewall policies in Google Cloud allow rules to be applied at the organization, folder, or project level and cascade downward. Creating a folder-level deny-all rule for outbound traffic blocks all egress from every project under the non-production folder by default. Then, within specific VPCs that need external access, lower-priority FQDN-based allowlist rules can override the folder-level deny for only those designated FQDNs. This architecture satisfies all requirements: the default is deny, specific FQDNs are permitted per VPC, and internal services are never exposed. Option A creates a global allowlist, which is too permissive. Option C applies a broad deny but the override mechanism described is not specific to VPCs. Option D uses Cloud NAT with IP filtering, which cannot perform FQDN-based filtering.

No community discussion yet for this question.