Google Professional Cloud Network Engineer Question 349
Single answerGoogle Cloud PlatformYou are designing a network architecture for a global e-commerce platform hosted on Google Cloud. The application requires strict access control to ensure that only specific IP ranges from partner companies can access the backend API hosted in two regions: us-central1 and europe-west1. Additionally, the firewall rules and policies must be centrally managed to maintain consistency across regions. What should you do to meet the requirements?
- A
Create regional firewall rules in each region to allow traffic only from the specific IP ranges.
- B
Use a global network firewall policy to allow traffic only from the specific IP ranges and apply it to the backend subnets in both regions.
- C
Configure separate Virtual Private Cloud (VPC) networks for each region and apply different firewall rules specific to each region.
- D
Set up Identity-Aware Proxy (IAP) for the backend API and enforce IP-based access control through the IAP configuration.
Show answer and explanation
Correct answer: B
Explanation
The best solution is to use a global network firewall policy because it allows you to apply consistent access control rules, such as restricting access to specific IP ranges, across multiple regions. This approach also simplifies management by centralizing the configuration, making it the most suitable choice for the given requirements.
- A. Incorrect.
Regional firewall rules can enforce access control, but they would need to be created and managed separately for each region, which does not meet the requirement for centralized management.
- B. Correct.
Global network firewall policies allow you to manage firewall rules at the organization or folder level and apply them consistently across multiple regions. This approach meets both the requirements for IP-based access control and centralized management.
- C. Incorrect.
Using separate VPC networks for each region complicates the architecture and does not address the need for centralized control of firewall rules.
- D. Incorrect.
Identity-Aware Proxy (IAP) adds a layer of user authentication but does not natively handle IP-based access control, which is required in this scenario.