Google Professional Cloud Network Engineer Question 343
Select 1Google Cloud PlatformYou are designing a multi-tier application on Google Cloud. The application consists of a web front end, an application tier, and a database tier. You need to ensure that only the web front-end instances can accept traffic from the internet, the application tier can only accept traffic from the web front-end tier, and the database tier can only accept traffic from the application tier. Which of the following actions should you take to implement this configuration?
- A
Create a VPC network and use subnet-level firewall rules to allow the required traffic between tiers.
- B
Use a shared VPC network and create service accounts to enforce communication restrictions between tiers.
- C
Apply instance-level firewall rules to specify allowed source IP ranges for each tier.
- D
Create a VPC network and configure firewall rules with target tags to restrict traffic between tiers.
- E
Use Cloud Load Balancing to enforce connectivity restrictions between the tiers.
Show answer and explanation
Correct answer: D
Explanation
To enforce tier-specific connectivity restrictions in Google Cloud, the best practice is to use VPC firewall rules with target tags. This approach allows you to group instances by their roles (e.g., web front-end, application tier, database tier) and apply precise traffic rules to control communication between these groups. Using target tags is scalable, easy to manage, and aligns with Google Cloud's best practices.
- A. Incorrect.
Subnet-level firewall rules cannot be used to differentiate traffic at the instance or tier level. This does not meet the requirement for restricting communication between specific tiers.
- B. Incorrect.
While shared VPC and service accounts are useful for managing resources across projects, they do not directly control network traffic between tiers.
- C. Incorrect.
Instance-level firewall rules can restrict traffic to specific instances, but it is not the recommended approach when managing tier-based traffic restrictions. It is less scalable and harder to manage.
- D. Correct.
Firewall rules with target tags are the recommended method for managing traffic restrictions between tiers in a Google Cloud VPC. Tags allow you to apply rules to specific groups of instances and enforce tier-based communication policies effectively.
- E. Incorrect.
Cloud Load Balancing is used for distributing traffic, not for restricting or enforcing connectivity between tiers.