Exercise 3: Does a Firewall Rule Update Need Repeating Per Region on GCP? — Possible Solution
====================================================================

No, the team does not need to repeat the update three more times.
Firewall rules on GCP are attached to the VPC network itself, and
because the VPC network is a real, global resource, a single firewall
rule automatically applies consistently across every region that
network has a subnet in - all four regions in this case - the moment
it's updated, with no per-region duplication required.

This is genuinely different from how the equivalent update works on
AWS. An AWS VPC is scoped to one Region, and security groups /
NACLs are themselves attached to that one Region's own VPC. If the
same organization's AWS architecture used four separate, per-region
VPCs to cover four regions (the real AWS norm, per Chapter 5's own
three-way comparison table), the team would need to make the
equivalent security-group or NACL change four separate times, once
per regional VPC, since there is no single global firewall construct
on AWS that would propagate the change automatically.

ANSWER: The team does not need to repeat the update, because GCP
firewall rules are attached to the VPC network itself, which is a
global resource - one update applies consistently across all four
regions immediately. On AWS, where the VPC (and therefore its
security groups and NACLs) is scoped to a single Region, the
equivalent change would need to be made separately in each of the
four regional VPCs.

WHY THIS WORKS AS AN ANSWER
------------------------------
This correctly applies the chapter's own central real finding - that
GCP firewall rules inherit the VPC's own global scope - to a concrete
scenario, and explains precisely why the same operation is more
labor-intensive on AWS due to its own per-region VPC scoping.