Google Professional Cloud Network Engineer Question 778
Single answerGoogle Cloud PlatformYou are designing the network architecture for a GCP project that will host multiple applications. Each application has its own team and requires isolation at the network level while remaining within the same project. How can you best achieve this requirement?
- A
Create separate VPCs for each application within the project.
- B
Create separate subnets in a shared VPC network for each application and use firewall rules to isolate traffic.
- C
Use a single VPC and configure private Service Perimeters to isolate the applications.
- D
Set up separate projects for each application to enforce network isolation by project boundaries.
Show answer and explanation
Correct answer: B
Explanation
To achieve network-level isolation while staying within the same project, you can use separate subnets for each application in a shared VPC and enforce isolation through tailored firewall rules. This approach is effective and aligns with the project's constraints and the capabilities of Google Cloud networking.
- A. Incorrect.
Creating separate VPCs for each application is not possible within a single project, as GCP enforces a one-VPC-per-project rule by default. Thus, this option is not valid.
- B. Correct.
Using separate subnets within a shared VPC and applying appropriate firewall rules is the correct option, as it allows you to provide isolation at the network level while staying within the same project.
- C. Incorrect.
Private Service Perimeters are a feature of VPC Service Controls, which focus on securing data services rather than isolating internal network traffic between applications. This approach does not meet the requirements.
- D. Incorrect.
Setting up separate projects for each application would provide isolation, but the requirement explicitly states that the solution needs to remain within the same project. Therefore, this option does not meet the requirements.