A company uses Shared VPC. Service project administrators must manage firewall rules that protect only the instances their own team runs, and the host project must not grant broad network-wide control. How should this be implemented?
Show answer and explanation
Answer: C
A conditional IAM binding on the host project lets a service project administrator manage firewall rules only when the condition matches, for example when the target instances carry network tags that the team owns. That keeps the grant narrow and supports least privilege. Compute Network Admin and Compute Security Admin apply across the shared network, so either one grants control over rules that affect other service projects. Shared VPC does support delegated firewall administration through IAM, so a separate VPC is not required.
Why the other options are wrong
- A. Compute Network Admin on the host project covers network-wide resources, including every firewall rule in the shared VPC. That reaches far beyond one team's instances.
- B. Compute Security Admin also spans firewall rules across the host project. Without a condition, it lets a team change rules that affect other service projects.
- D. Shared VPC supports delegated firewall administration through IAM. Splitting into separate VPCs adds peering and routing overhead that the requirement does not call for.