How to Centralize GCP Infrastructure Management with Terraform?

PCNE By islever Editorial Last updated

Short answer

B Create a single Shared VPC and attach each Google Cloud project as a service project.

Question

You are planning to use Terraform to deploy the Google Cloud infrastructure for your company. The design must meet the following requirements: • Each Google Cloud project must represent an internal project that your team will work on. • After an internal project is finished, the infrastructure must be deleted. • Each internal project must have its own Google Cloud project owner to manage the Google Cloud resources. • You have 10-100 projects deployed at a time. While you are writing the Terraform code, you need to ensure that the deployment is simple and the code is reusable with centralized management. What should you do?
  1. Create a single project and single VPC for each internal project.
  2. Create a single Shared VPC and attach each Google Cloud project as a service project. Correct Answer
  3. Create a single project and additional VPCs for each internal project.

Key Takeaways

Tests the ability to select a scalable cloud networking model that satisfies both centralized management and per-project lifecycle requirements, often trapping candidates into over-prioritizing isolated deletion boundaries.

This question evaluates the optimal GCP networking architecture for multi-project deployments using Terraform. The community consensus strongly supports Shared VPC (Option B) to balance centralized network management with independent project ownership and scalable lifecycle handling.

Common mistake: Candidates frequently select Option A, prioritizing straightforward project deletion over the explicit requirement for centralized management, which increases operational overhead and violates the reusable code constraint at scale.

Expert Analysis

Why the Answer Is Correct

Shared VPC architecture enables a single host project to centrally manage routing, firewall rules, and subnets while multiple service projects attach to it. This design directly satisfies the requirement for centralized management across 10–100 projects while allowing each internal project to maintain its own dedicated owner via IAM delegation. Terraform modules can efficiently provision these service projects independently, ensuring reusable code and streamlined infrastructure orchestration without cross-project dependency conflicts.

Why the Other Options Are Wrong

Option A forces complete network isolation per project, which contradicts the centralized management mandate and creates significant scaling overhead for dozens of concurrent deployments. Option C incorrectly bundles multiple VPCs into a single project, complicating route tables, firewall rule management, and IAM boundary definitions. Both approaches fail to leverage Terraform’s modular capabilities for consistent, cross-project infrastructure automation.

Community Comment Notes

Comment [1] correctly identifies centralized management as the primary driver for selecting Shared VPC over isolated setups. Comment [2] raises a valid point about deletion simplicity but overlooks that service projects can be deleted independently without orphaning the host network or violating cleanup requirements. Comment [4] accurately reinforces that Shared VPC inherently requires distinct host and service projects, validating the architectural choice and clarifying common misconceptions.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When evaluating cloud architecture questions, explicitly map every stated constraint to the solution before considering edge cases like deletion workflows. Prioritize answers that satisfy scalability and centralized control requirements, as they typically outweigh minor operational preferences in certification scenarios.

Community Votes

B
75%
A
25%

75% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. gonlafer 👍 3 Answered B
    When it comes to centralized management... I'd go to B.
  2. 3574e4e 👍 1 Answered A
    With single project and single VPC for each internal project everything related to the internal project will be removed when the Google Cloud project is deleted. With Shared VPC there will always be something in the host project that won't be easy to delete with the project. Since there are no requirements for connectivity between the projects, I'll go for A.
  3. dev62 👍 1
    Option D : Shared VPC allows you to create a single VPC network that can be shared across multiple Google Cloud projects. Each internal project (Department A and Department B) can be attached as a service project to the Shared VPC. This approach centralizes management while allowing each project to have its own owner.
  4. PeppaPig 👍 1
    B is correct D is wrong because shared VPC and service project must be different projects

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Resolve BGP Session Failures on Cloud Interconnect?

S-grade

Deploying Packet Mirroring Policies in GCP Regions

S-grade

Troubleshooting Asymmetric Traffic on Google Cloud Interconnect

S-grade

How to Configure DNS Forwarding Across Isolated VPC Networks?

S-grade

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide