PCNE Implementing VPC Instances Practice Question
A company wants to apply consistent firewall rules across all projects in an organization. They need to block all traffic to ports 22 and 3389 from the internet to any VMs in any project. Which approach is most scalable and maintainable?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a hierarchical firewall policy at the organization level with deny rules for ports 22 and 3389 from 0.0.0.0/0.
Hierarchical firewall policies allow you to define firewall rules at the organization or folder level that apply to all VPCs under that node. This ensures consistency and avoids duplication across projects. The policy is evaluated before VPC firewall rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a hierarchical firewall policy at the organization level with deny rules for ports 22 and 3389 from 0.0.0.0/0.
Why this is correct
Hierarchical policies apply to all projects under the org, ensuring consistency.
- ✗
Configure OS-level firewall on each VM using startup scripts.
Why it's wrong here
This is not centralized and difficult to maintain.
- ✗
Use Cloud Armor security policies attached to load balancers.
Why it's wrong here
Cloud Armor protects load-balanced traffic, not all VMs directly.
- ✗
Create a VPC firewall rule in each project's VPC.
Why it's wrong here
This is not scalable; managing rules across many projects is error-prone.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.