Associate Cloud Engineer free question 5 / 10 · Domain 2: Planning and implementing a cloud solution
You are considering switching from network tags to secure tags in Cloud NGFW rules. According to the comparison table on the page about secure tags for firewalls, which two statements are correct? (Choose two.)
- Secure tag keys are created on the organization, not under a project
- Network tags can also be used in rules of firewall policies
- A single secure tag key can hold up to 1,000 different values
- Who can manage and use secure tags can be decided with IAM policies
Show the answer and explanation
Answer: C, D
Why this is correct
In the page's comparison table, secure tags can use IAM for access control, whereas network tags have no access control. In structure, a secure tag is a tag key that can hold up to 1,000 values, whereas a network tag is a simple string. Cloud NGFW rules specify sources and targets by tag, which lets you write rules flexibly without depending on IP addresses.
Why the other options are wrong
"Network tags can also be used in rules of firewall policies" … The page says network tags can be used as sources or targets of VPC firewall rules, but not in rules of hierarchical firewall policies, global network firewall policies, or regional network firewall policies.
"Secure tag keys are created on the organization, not under a project" … The table says the parent resource of a secure tag is a project or an organization, so you can also create a tag key with a project as its parent. It is the network tag whose parent is limited to a project.
Where they apply
A secure tag key can name a specific VPC network in its purpose data (purpose-data) or an organization. A tag that specifies a VPC applies only to the network interfaces of VMs in that VPC, and a tag that specifies an organization applies to VMs in any VPC network of the parent organization.
In the table, the simple string is the network tag, while the secure tag has a structure of tag key and value. The parent resource of a network tag is a project, and a secure tag can have an organization as its parent.
Go to the Associate Cloud Engineer practice app (10 free questions; purchase unlocks all questions)