Google Professional Cloud Network Engineer Question 97
Select 3Google Cloud PlatformYour organization has a multi-tier application deployed on Google Cloud, consisting of separate VPCs for the frontend, backend, and database tiers. You are tasked with designing a firewall strategy to ensure secure communication between these tiers, while also allowing external traffic to the frontend tier. Additionally, you need to ensure that database access is restricted to the backend tier only. Which of the following steps should you include in your firewall strategy?
- A
Create a VPC firewall rule in the frontend VPC to allow ingress traffic from the internet on the required ports.
- B
Create a hierarchical firewall rule to allow ingress traffic only from the backend VPC to the database VPC.
- C
Create a VPC firewall rule in the backend VPC to allow ingress traffic only from the frontend VPC.
- D
Create a hierarchical firewall rule to block all internet traffic to the database VPC.
- E
Create a VPC firewall rule in the database VPC to allow ingress traffic from any source.
Show answer and explanation
Correct answers: A, B, D
Explanation
The firewall strategy must ensure that the application tiers can communicate securely while minimizing exposure to external threats. VPC firewall rules are used for intra-VPC traffic control, whereas hierarchical firewall rules are effective for cross-VPC controls and broader policies. By allowing only the necessary traffic between tiers and blocking external access to sensitive resources like the database tier, you achieve a secure and compliant design.
- A. Correct.
This is correct because the frontend tier needs to accept traffic from external sources (e.g., users) on specific ports, such as HTTP (80) or HTTPS (443).
- B. Correct.
This is correct because hierarchical firewall rules can apply across multiple VPCs, making it an effective way to enforce restrictions on database access to only the backend tier.
- C. Incorrect.
This is incorrect because the backend VPC does not require a rule to restrict ingress from the frontend VPC; instead, the frontend VPC controls its own egress rules.
- D. Correct.
This is correct because blocking all internet traffic to the database VPC ensures that it is not exposed to external sources, adhering to security best practices.
- E. Incorrect.
This is incorrect because allowing ingress traffic to the database VPC from any source violates the principle of least privilege and introduces security risks.