Google Professional Cloud Network Engineer Question 64
Select 3Google Cloud PlatformYou are designing a Virtual Private Cloud (VPC) network for a multi-tier application deployment. The application has a web front-end, an API tier, and a database backend. The web front-end needs to be accessible from the internet, while the API tier and database backend must only be accessible internally. Which design considerations should you prioritize when creating the VPC network?
- A
Create a custom mode VPC to have full control over IP address ranges and subnets.
- B
Use a single subnet for all tiers to simplify network configuration.
- C
Deploy the database backend in a private subnet with no external IP addresses.
- D
Configure firewall rules to allow public access to the API tier.
- E
Assign different subnets for each application tier to enhance network segmentation.
Show answer and explanation
Correct answers: A, C, E
Explanation
When designing a VPC network for a multi-tier application, it is critical to balance accessibility and security. A custom mode VPC allows flexibility in defining subnets and IP ranges, private subnets protect sensitive resources like databases, and assigning different subnets for each tier enhances segmentation and control. Avoid practices like using a single subnet or exposing internal tiers to the internet, as these compromise security and scalability.
- A. Correct.
Creating a custom mode VPC is important because it allows you to explicitly define IP address ranges and subnets, which is crucial for a multi-tier architecture.
- B. Incorrect.
Using a single subnet for all tiers is not recommended because it reduces network segmentation and security, making it harder to manage access control between tiers.
- C. Correct.
Deploying the database backend in a private subnet ensures security by preventing direct external access to sensitive data.
- D. Incorrect.
Allowing public access to the API tier is a poor practice, as the API should be internally accessible only to the web front-end or other internal components.
- E. Correct.
Assigning different subnets for each application tier provides better network segmentation, enabling more granular control over communication and security policies.