PCNE Implementing network security Practice Question
An organization has a Shared VPC with several service projects. They want to restrict which service projects can create firewall rules in the host project. What should they do?
⚠ Common exam trap
Candidates often confuse VPC Service Controls or hierarchical firewall policies with IAM-based permission control, mistakenly thinking these features can restrict which service projects can create firewall rules, when they actually serve different purposes (data exfiltration prevention and rule enforcement, respectively).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use IAM roles with compute.firewalls.create permission at the host project level.
IAM roles with the `compute.firewalls.create` permission at the host project level allow you to precisely control which service projects can create firewall rules in the Shared VPC host project. By assigning a custom or predefined role (e.g., Compute Security Admin) that includes this permission to specific service project identities, you can restrict firewall rule creation to only authorized service projects while preventing others from doing so.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use IAM roles with compute.firewalls.create permission at the host project level.
Why this is correct
IAM allows fine-grained control over who can create firewall rules in the host project.
- ✗
Use VPC Service Controls.
Why it's wrong here
VPC Service Controls protect managed services, not firewall rule creation.
- ✗
Use hierarchical firewall policies.
Why it's wrong here
Hierarchical firewall policies set rules across projects, but do not restrict who can create rules.
- ✗
Use organization policies to deny firewall rule creation.
Why it's wrong here
Organization policies are not granular to specific service projects within a Shared VPC.
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.