Google Professional Cloud Network Engineer Question 172
Select 3Google Cloud PlatformYou are designing a multi-tier application on Google Cloud that consists of a frontend hosted on Compute Engine and a backend running on a managed instance group. The frontend instances need to communicate with the backend instances securely without exposing the backend to the public internet. Which combination of Google Cloud features should you use to achieve this?
- A
VPC network with subnets for frontend and backend, and an internal load balancer for backend communication
- B
Firewall rules to allow ingress traffic from the frontend subnet to the backend subnet
- C
A Cloud VPN to establish a secure connection between the frontend and backend subnets
- D
Private Google Access for the backend to restrict access to private IP addresses only
- E
Service accounts for the frontend instances to authenticate when accessing the backend
Show answer and explanation
Correct answers: A, B, E
Explanation
To enable secure communication between the frontend and backend instances in Google Cloud, you should use a VPC network with subnets for isolation, an internal load balancer for private communication, and firewall rules to allow only the necessary traffic. Additionally, using service accounts ensures that the frontend instances are authorized to access the backend. These features together provide a secure and efficient design for the multi-tier application.
- A. Correct.
Using a VPC network with separate subnets for the frontend and backend ensures isolation between tiers, and an internal load balancer allows secure internal communication within the private network.
- B. Correct.
Firewall rules are necessary to allow the required ingress traffic from the frontend subnet to the backend subnet while maintaining security.
- C. Incorrect.
A Cloud VPN is not required for communication between resources in the same VPC network. It is typically used to connect on-premises networks with Google Cloud.
- D. Incorrect.
Private Google Access is used to allow instances without external IP addresses to access Google APIs and services. It is not relevant for this scenario.
- E. Correct.
Service accounts enable secure and authenticated communication between the frontend and backend instances, ensuring that only authorized instances can access the backend.