Google Professional Cloud Network Engineer Question 44
Select 3Google Cloud PlatformYou are a Cloud Network Engineer for a retail company that uses Google Cloud. The company wants to implement micro-segmentation to enhance security in their environment. They have multiple VM instances and services running in a single VPC across different subnets. Each service has a specific role and should only communicate with authorized services. Which of the following approaches would enable micro-segmentation by leveraging Google Cloud's features?
- A
Use firewall rules with instance tags to restrict traffic between services.
- B
Configure IAM roles for all services to control network communication.
- C
Implement firewall rules using service accounts for granular control.
- D
Use hierarchical firewall rules to apply micro-segmentation policies across all projects.
- E
Leverage secure tags in conjunction with firewall policies to define allowed traffic.
Show answer and explanation
Correct answers: A, C, E
Explanation
Micro-segmentation in Google Cloud can be achieved through features like instance tags, service accounts, and secure tags, which allow you to apply granular firewall rules to control traffic between services or VMs. Instance tags and secure tags provide resource-level tagging for policy application, while service accounts enable identity-based policy enforcement. IAM roles and hierarchical firewall rules, while important for other aspects of security and policy management, do not directly address the requirements for micro-segmentation.
- A. Correct.
Using firewall rules with instance tags is an effective way to apply granular network policies based on the tags assigned to VM instances. This is a core approach for enabling micro-segmentation in Google Cloud.
- B. Incorrect.
IAM roles are used for access control to Google Cloud resources but are not relevant for controlling or segmenting network traffic.
- C. Correct.
Firewall rules using service accounts allow for fine-grained control over network communications by associating rules with the identity of the service, which is a key aspect of micro-segmentation.
- D. Incorrect.
Hierarchical firewall rules are useful for applying policies across multiple projects, but they are not inherently designed for micro-segmentation within a single VPC or service.
- E. Correct.
Secure tags are a powerful feature in Google Cloud that can be used to define and enforce micro-segmentation policies by tagging resources and creating rules based on those tags.