Google Professional Cloud Network Engineer Question 45
Select 3Google Cloud PlatformYour organization is implementing a microservices-based architecture on Google Cloud and wants to enhance security by limiting communication between services to only what is necessary. You are tasked with designing a solution that uses micro-segmentation principles to achieve this. Which of the following steps should you take to ensure secure communication between services?
- A
Use network tags on Compute Engine instances and define firewall rules to restrict traffic between services.
- B
Leverage service accounts for each microservice and configure IAM policies to allow only necessary permissions.
- C
Implement VPC Service Controls to isolate microservices within a secure perimeter.
- D
Use secure tags with Identity-Aware Proxy (IAP) to control access to microservices.
- E
Create custom service accounts for each service and use mutual TLS (mTLS) for service-to-service authentication.
Show answer and explanation
Correct answers: A, B, E
Explanation
Micro-segmentation aims to restrict communication between services to only what is necessary, improving security. In Google Cloud, this can be achieved by using network tags for fine-grained traffic control, service accounts with IAM policies for least privilege access, and mutual TLS (mTLS) for secure service-to-service authentication. VPC Service Controls and IAP are not specifically designed for implementing micro-segmentation between services in this scenario.
- A. Correct.
Using network tags allows you to define specific firewall rules for microservices, ensuring traffic is restricted based on the micro-segmentation principle.
- B. Correct.
Service accounts, combined with IAM policies, help enforce the principle of least privilege, ensuring that each microservice only has the permissions it requires.
- C. Incorrect.
While VPC Service Controls enhance security, they are primarily used for securing data access across Google Cloud services and do not directly enable service-to-service micro-segmentation.
- D. Incorrect.
Secure tags and IAP are useful for securing user access to applications but are not directly applicable for implementing micro-segmentation between microservices.
- E. Correct.
Using custom service accounts and mTLS ensures secure authentication and encrypted communication between services, aligning with micro-segmentation principles.