An organisation wants a central networking team to own subnets, firewall rules, and IP ranges, while several application teams deploy virtual machines that attach directly into those shared subnets across projects. Which capability meets this requirement?
- AVPC Network Peering between each application project and the central project, so workloads reach the shared subnets over private addresses.
- BA custom-mode VPC network replicated in each application project, kept aligned by exporting and importing the same subnet definitions across them.
- CCloud NGFW policies applied at the organisation node, which let application projects borrow subnets defined higher in the resource hierarchy.
- DShared VPC, where the central project is the host project and the application projects are service projects using the shared subnets. Correct
Why A is wrong: Peering connects two separate VPC networks and lets them route to each other privately, but each side keeps its own subnets and firewall rules. It does not let application virtual machines attach into subnets the central team owns, which is the stated need.
Why B is wrong: Copying subnet definitions into separate networks produces independent VPCs, not shared ownership. There is no import mechanism that makes application virtual machines attach into a central team's subnets, so the central control requirement is unmet.
Why C is wrong: Firewall policies can be attached to organisation or folder nodes to govern traffic, but they filter packets rather than share subnets. Subnets are not inherited down the hierarchy, so this does not give application teams access to central subnets.
Why D is correct: Correct: Shared VPC designates a host project that owns the network, subnets, and firewall rules, and service projects place virtual machines directly into those shared subnets, centralising control exactly as described.