A central network team must control networking for many project teams. What is the standard design?
Why D is the answer
Shared VPC with a host project
Shared VPC keeps network administration central while teams run workloads in their own projects.
In detail
- Shared VPC lets a host project control networks for other projects.
- Teams still control their own apps.
Use case
An illustrative scenario, not a real incident.
A network team owns subnets and firewall rules in a host project, while app teams run workloads in their own projects.
See it in different ways
flowchart TD A["Host project: Shared VPC"] --> B["Service project A"] A --> C["Service project B"] A --> D["Central firewall rules"]
mindmap
root((Connectivity))
Hybrid
Cloud Interconnect
Cloud VPN
Shared
Shared VPC
Private access
Private Service Connect
Identity-Aware Proxy
APIs
Apigeemindmap
root(("Host project"))
n1["Service projects"]
n2["Team A"]
n3["Team B"]
n4["Team C"]Key point: Shared VPC centralizes networking.
Why the other options are wrong
- A. Public IPs on all VMs
- Public IPs raise risk.
- B. One project for all teams
- One project removes separation.
- C. A separate VPC per team with no controls
- No controls is the opposite.