Google Professional Cloud Network Engineer Question 458
Select 3Google Cloud PlatformYour organization has deployed a multi-tier application on Google Cloud using a Virtual Private Cloud (VPC). The application consists of a front-end web server on a managed instance group, a back-end application server on a separate instance group, and a Cloud SQL database. You need to enforce a security policy to ensure the following:
- Only the front-end web server can be accessed from the internet over HTTPS.
- The back-end application server can only communicate with the front-end web server over specific ports.
- The Cloud SQL database should only be accessible from the back-end application server.
Which combination of security policies should you configure to meet these requirements?
- A
Create a firewall rule to allow ingress traffic on port 443 to the front-end web server with a source filter set to 0.0.0.0/0.
- B
Create a firewall rule to allow ingress traffic on port 3306 from the front-end web server to the Cloud SQL database.
- C
Create a firewall rule to allow ingress traffic on the required ports (e.g., 8080) from the front-end web server to the back-end application server.
- D
Create a firewall rule to allow ingress traffic on port 3306 from the back-end application server to the Cloud SQL database.
- E
Create a firewall rule to allow ingress traffic on all ports from the front-end web server to the back-end application server.
Show answer and explanation
Correct answers: A, C, D
Explanation
To meet the security requirements, you need a combination of firewall rules that enforce specific communication flows between the components of the application. Option 1 allows secure HTTPS traffic to the front-end from the internet, option 3 enables controlled communication between the front-end and back-end on specific ports, and option 4 restricts access to the Cloud SQL database to only the back-end application server. This ensures the application is secure while maintaining the required functionality.
- A. Correct.
This option is correct because it ensures that the front-end web server can be accessed from the internet over HTTPS (port 443) and restricts access to public IPs by using 0.0.0.0/0 as the source filter.
- B. Incorrect.
This option is incorrect because the front-end web server should not directly access the Cloud SQL database. Only the back-end application server is allowed to do so.
- C. Correct.
This option is correct because it allows the front-end web server to communicate with the back-end application server over the required ports (e.g., 8080).
- D. Correct.
This option is correct because it ensures that only the back-end application server can access the Cloud SQL database on port 3306, which meets the security requirement.
- E. Incorrect.
This option is incorrect because allowing ingress traffic on all ports from the front-end web server to the back-end application server violates the principle of least privilege and creates unnecessary exposure.