Google Professional Cloud Network Engineer Question 351
Select 2Google Cloud PlatformYou are designing a Google Cloud environment for a company that has strict security requirements. Virtual machine (VM) instances must be grouped into security tiers, and each tier should have specific firewall rules applied. The company wants to use a combination of target network tags, service accounts, and secure tags to manage these rules. Which of the following actions will allow you to enforce these requirements effectively?
- A
Assign target network tags to the VMs and use the tags in firewall rule configurations.
- B
Use service accounts to group VMs and create firewall rules that target these service accounts.
- C
Create secure tags in Identity and Access Management (IAM) and use them in firewall rule configurations.
- D
Apply secure tags directly to the VMs to enforce firewall rules.
- E
Use secure tags to grant IAM permissions instead of configuring firewall rules.
Show answer and explanation
Correct answers: A, B
Explanation
To enforce firewall rules effectively, you can use target network tags or service accounts. Target network tags allow logical grouping of VMs, and service accounts enable rule application based on the identity of the VM. Secure tags are used for IAM policy-based access control and cannot be used in firewall rule configurations.
- A. Correct.
Target network tags can be used to group VMs logically. Firewall rules can then be created to target these tags, making them an effective method for applying rules to specific sets of VMs.
- B. Correct.
Firewall rules can target service accounts, which allows you to apply rules to all VMs that use a specific service account. This is another effective way to manage security tiers.
- C. Incorrect.
Secure tags are not currently supported for direct use in firewall rule configurations. They are used for IAM policies but not for configuring firewall rules.
- D. Incorrect.
Secure tags cannot be directly applied to VMs or used to enforce firewall rules. Secure tags are primarily used for IAM policy enforcement.
- E. Incorrect.
While secure tags are useful for IAM permissions, they are not designed for configuring firewall rules. Firewall rules require target network tags or service accounts.