Google Professional Cloud Network Engineer Question 63
Single answerGoogle Cloud PlatformYou are designing a Virtual Private Cloud (VPC) network for a multi-tier application hosted on Google Cloud. The application consists of a web tier, an application tier, and a database tier. Each tier should be isolated from the other tiers but still allow the necessary communication between them. What is the most appropriate design for this VPC network?
- A
Create a single VPC network with a single subnet and use firewall rules to control access between the tiers.
- B
Create a single VPC network with separate subnets for each tier, and use subnet-level firewall rules to control access between the tiers.
- C
Create separate VPC networks for each tier and use VPC peering to allow communication between the tiers.
- D
Create a single VPC network with separate subnets for each tier, along with internal load balancers to manage traffic between the tiers.
Show answer and explanation
Correct answer: B
Explanation
The most appropriate design for this scenario is to use a single VPC network with separate subnets for each tier. This approach provides logical isolation between tiers while allowing necessary communication through precise firewall rules. It ensures a balance between simplicity, security, and performance without introducing unnecessary complexity.
- A. Incorrect.
Using a single subnet for all tiers does not provide sufficient isolation between tiers, which can lead to potential security and performance issues.
- B. Correct.
Creating a single VPC network with separate subnets for each tier allows for proper isolation and controlled communication between tiers. Subnet-level firewall rules can ensure that only the necessary traffic is allowed between the tiers.
- C. Incorrect.
Creating separate VPC networks for each tier is unnecessarily complex and can complicate network management. While VPC peering can allow communication, it does not inherently address isolation within a single application.
- D. Incorrect.
Using internal load balancers is not necessary for tier-to-tier communication in this scenario. The primary goal is isolation and controlled communication, which can be achieved using subnets and firewall rules without additional load balancing.