Google Professional Cloud Network Engineer Question 354
Select 2Google Cloud PlatformYou are designing a Google Cloud network for a retail application that has multiple environments: development, staging, and production. Each environment uses its own Compute Engine instances. The security team requires that firewall rules strictly allow only specific traffic to and from instances based on their environment. You decide to use target network tags, service accounts, and secure tags to implement this requirement. Which of the following design strategies will meet the requirement?
- A
Assign unique network tags to instances in each environment and create firewall rules referencing those tags.
- B
Use unique service accounts for instances in each environment and create firewall rules referencing the service accounts.
- C
Use secure tags to dynamically group instances based on their environment and apply firewall rules to those secure tags.
- D
Assign the same network tag to all instances across all environments and create generic firewall rules.
- E
Use default service accounts for all instances and create environment-specific firewall rules based on instance names.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirement of environment-specific traffic control, you can use either unique network tags or unique service accounts for instances in each environment. Both approaches allow you to create precise firewall rules targeting specific environments. Secure tags are not applicable for firewall rules, and using the same tag or default service accounts does not provide adequate isolation for environments.
- A. Correct.
Correct: Assigning unique network tags to instances in each environment allows you to create specific firewall rules targeting only those instances. This aligns with the requirement to control traffic based on the environment.
- B. Correct.
Correct: Using unique service accounts for instances in each environment provides an alternative way to create firewall rules, as service accounts can be used as targets in firewall rules.
- C. Incorrect.
Incorrect: Secure tags are used for Identity and Access Management (IAM) purposes, not for creating firewall rules. They cannot be directly referenced in firewall rules.
- D. Incorrect.
Incorrect: Using the same network tag for all instances does not allow for environment-specific traffic control. This violates the requirement to restrict traffic based on the environment.
- E. Incorrect.
Incorrect: Default service accounts and instance names are not recommended for creating firewall rules. This approach is error-prone and does not align with best practices for managing access control.