GCP Professional Cloud Security Engineer Practice Question

A single ingress firewall rule in the prod-host project that targets the specific workload service account and allows TCP port 443 only from 203.0.113.0/24 limits exposure to just the web-tier VMs, even though they share subnets with other instances. Using the target service accounts selector is supported across all service projects attached to the Shared VPC, unlike network tags that require consistent manual tagging and can be mistakenly applied to non-web instances. Applying the rule at a higher priority than a broad deny-all ingress rule ensures traffic is accepted only for the intended destination; no egress rule is needed because return packets are automatically allowed by connection tracking. The other options either expose additional instances, depend on fragile tag management, or add an unnecessary egress rule.