Professional Cloud ArchitectDemo

Question

A company has a networking team and a development team. The development team operates applications on Compute Engine instances containing sensitive data. The development team needs administrative permissions for Compute Engine. The company requires that the networking team manage all network resources. The development team does not want the networking team to access the sensitive data on the instances. What should you do?

A
1. Create a project with a standalone VPC and assign the Network Admin role to the networking team. 2. Create a second project with a standalone VPC and assign the Compute Admin role to the development team. 3. Use Cloud VPN to join the two VPCs.
B
1. Create a project with a standalone Virtual Private Cloud (VPC), assign the Network Admin role to the networking team, and assign the Compute Admin role to the development team.
C
1. Create a project with a Shared VPC and assign the Network Admin role to the networking team. 2. Create a second project without a VPC, configure it as a Shared VPC service project, and assign the Compute Admin role to the development team.
D
1. Create a project with a standalone VPC and assign the Network Admin role to the networking team. 2. Create a second project with a standalone VPC and assign the Compute Admin role to the development team. 3. Use VPC Peering to join the two VPCs.

Explanation

Shared VPC centralizes VPC network resources in a host project while allowing application resources, including Compute Engine instances, to reside in attached service projects. The Network Admin role on the host project manages network resources but does not grant administration of instances and disks in the service project, preserving separation from sensitive workload data. The development team can receive Compute Admin in the service project to manage its Compute Engine resources.

Learn more

Professional Cloud ArchitectDemo

AstroTutor

Notes

Readiness

QuestionQ183

Community Discussion