Question

A financial services company runs workloads across dozens of projects under a single Google Cloud organization. The security team must enforce a baseline rule that blocks all inbound RDP (TCP 3389) traffic from the public internet across every project, and application teams must not be able to override or delete this rule. Individual project teams still need the freedom to create their own less-restrictive firewall rules for internal traffic. Which approach best meets these requirements?

Accepted Answer

Create a hierarchical firewall policy at the organization level with a deny rule for TCP 3389 from 0.0.0.0/0, and let project teams manage their own VPC firewall rules.

Answer

Ask each project team to add a VPC firewall rule denying TCP 3389 from 0.0.0.0/0 and rely on periodic audits to confirm compliance.

Answer

Enable a VPC Service Controls perimeter around all projects to block RDP ingress from the internet.

Answer

Configure a single shared VPC with a firewall rule denying TCP 3389 and migrate all workloads into that VPC.