Google Cloud Professional Cloud Architect PCA — Question 215

To improve governance and security, your organization has structured the Google Cloud environment using folders for different business units. Each business unit folder has subfolders for development, staging, and production environments, which must comply with internal security controls: • Production workloads must be protected from direct internet ingress by default unless explicitly tagged. • The application must be accessible to customers over HTTPS. You need to design a scalable and enforceable model that blocks internet ingress traffic to the production folders while selectively allowing direct HTTPS traffic to the necessary virtual machines. You must also ensure that individual project teams cannot overwrite these controls once they are implemented for all current and future production projects. What should you do?