Google Associate Cloud Engineer Question 154
Select 2Google Cloud PlatformYou are tasked with setting up a secure network infrastructure on Google Cloud for a new application. The application requires two subnets: one for web servers that should be accessible from the internet, and another for database servers that should only be accessible from within the VPC. How would you configure the subnets to meet these requirements?
- A
Create one subnet and use firewall rules to control access to different server types.
- B
Create two subnets: one with public IPs for web servers and one without public IPs for database servers.
- C
Use a single subnet with both public and private IP ranges.
- D
Create two subnets in the same VPC and set up Cloud NAT for the database subnet.
- E
Create two subnets in different VPCs and set up VPC peering for communication.
Show answer and explanation
Correct answers: B, D
Explanation
To achieve the desired network setup, you should create two separate subnets within the same VPC: one subnet with public IPs for web servers to allow internet access and another subnet without public IPs for database servers to restrict access. Additionally, configuring Cloud NAT for the database subnet allows outbound internet access for necessary updates while maintaining security.
- A. Incorrect.
Creating one subnet and using firewall rules is not the best approach for isolating web and database traffic securely as both would be on the same subnet.
- B. Correct.
Creating two subnets with appropriate IP configuration ensures that web servers are accessible from the internet while database servers are not.
- C. Incorrect.
Using a single subnet with both public and private IP ranges does not provide the desired isolation between web and database servers.
- D. Correct.
Creating two subnets and using Cloud NAT helps the database subnet access the internet for updates without exposing it to the internet.
- E. Incorrect.
Creating subnets in different VPCs and using VPC peering is more complex and unnecessary for this requirement, as both subnets can be in the same VPC.