Google Professional Cloud Network Engineer Question 43
Select 3Google Cloud PlatformYour company has a multi-tier application deployed on Google Cloud, consisting of a frontend, a set of microservices, and a database. For security purposes, you need to restrict communication so that the frontend can only talk to specific microservices, and the microservices can only query the database. Which of the following approaches should you implement to achieve micro-segmentation using Google Cloud features?
- A
Use secure tags to define access policies for each tier and configure firewall rules accordingly.
- B
Assign unique service accounts to each tier and use IAM policies to control inter-tier communication.
- C
Use VPC Service Controls to restrict communication between the tiers.
- D
Configure ingress and egress firewall rules based on network tags for each tier.
- E
Implement Cloud Armor policies to restrict communication between the tiers.
Show answer and explanation
Correct answers: A, B, D
Explanation
Micro-segmentation in Google Cloud can be achieved by combining secure tags, service accounts, and firewall rules. Secure tags and network tags help define and enforce traffic restrictions using firewall rules, while service accounts enable identity-based access control. VPC Service Controls and Cloud Armor are not suitable for this specific use case.
- A. Correct.
Using secure tags is a recommended method for micro-segmentation. You can apply tags to resources and define firewall rules based on these tags to control traffic flow between tiers.
- B. Correct.
Assigning unique service accounts to each tier allows you to enforce identity-based access control for inter-tier communication. This ensures only authorized tiers can communicate with each other.
- C. Incorrect.
VPC Service Controls are used to restrict access to Google-managed services and are not designed for controlling communication between tiers within a VPC.
- D. Correct.
Firewall rules based on network tags are another effective way to achieve micro-segmentation by defining ingress and egress rules for each tier.
- E. Incorrect.
Cloud Armor is primarily used for protecting external-facing applications from attacks and is not typically used for micro-segmentation within a VPC.