Question

A large enterprise organizes its Google Cloud resources with an organization node, a 'security-controls' folder, and multiple team folders beneath it. The central security team defines a hierarchical firewall policy attached at the organization level that must enforce a mandatory deny on all inbound RDP (TCP 3389) from the internet, while allowing individual application teams to define their own rules for other traffic in their project-level network firewall policies. However, for a specific range of trusted corporate egress IPs, the security team wants lower-level policies and rules to be able to make the final allow/deny decision for RDP rather than having it blocked at the org level. Which configuration correctly meets these requirements?

Accepted Answer

Create an org-level hierarchical policy with a 'deny' rule for TCP 3389 from 0.0.0.0/0, plus a higher-priority 'goto_next' rule for TCP 3389 from the trusted corporate IP range.

Answer

Create an org-level hierarchical policy with an 'allow' rule for TCP 3389 from the trusted corporate IP range, and rely on VPC implied rules to deny all other RDP.

Answer

Create the deny rule for TCP 3389 only in each project's network firewall policy, since hierarchical policies cannot use the 'goto_next' action.

Answer

Attach the hierarchical policy to the 'security-controls' folder with a single 'deny' rule for TCP 3389, which automatically exempts the trusted IP range through evaluation order.