Google Professional Cloud Network Engineer Question 5
Select 3Google Cloud PlatformYour organization is planning to deploy a multi-tier application on Google Cloud. The application consists of a front-end web tier, a middle-tier API service, and a back-end database. Each tier should be able to scale independently. Additionally, the front-end must be accessible to users globally, while the database should only be accessible from the middle tier. Which design considerations should you include when creating the network architecture?
- A
Use a global external HTTP(S) Load Balancer to distribute traffic to the front-end web tier.
- B
Deploy the database in a public subnet to ensure scalability and accessibility.
- C
Use VPC Service Controls to restrict access between the middle-tier and the database.
- D
Create separate subnets for each tier and use firewall rules to control inter-tier communication.
- E
Enable Cloud NAT for the middle-tier API service to access external APIs securely.
Show answer and explanation
Correct answers: A, D, E
Explanation
Designing a scalable and secure network architecture for a multi-tier application involves using appropriate Google Cloud services and configurations. The global external HTTP(S) Load Balancer ensures global accessibility for the front-end, while separate subnets and firewall rules isolate and secure each tier. Cloud NAT enables secure outbound traffic for the middle-tier API service. Deploying the database in a public subnet or relying solely on VPC Service Controls would violate security best practices.
- A. Correct.
Correct: A global external HTTP(S) Load Balancer is ideal for distributing traffic to the front-end web tier and ensuring global accessibility for users.
- B. Incorrect.
Incorrect: Deploying the database in a public subnet would expose it to external threats. Databases should typically reside in a private subnet for security.
- C. Incorrect.
Incorrect: While VPC Service Controls are useful for securing access to Google-managed services, they are not the correct solution for securing communication between the middle-tier and the database in this scenario.
- D. Correct.
Correct: Creating separate subnets for each tier and defining firewall rules ensures proper isolation and controlled communication between the tiers.
- E. Correct.
Correct: Enabling Cloud NAT allows the middle-tier API service to securely access external APIs without exposing the service to the public internet.