Google Professional Cloud Security Engineer Question 206
Select 2Google Cloud PlatformYour organization is deploying a multi-tier application on Google Cloud. The front-end application must be accessible over the internet, while the back-end database must only be accessible internally within your VPC. How should you configure the IP addressing to meet these requirements?
- A
Assign a public IP address to the front-end application and a private IP address to the back-end database.
- B
Assign a private IP address to both the front-end application and the back-end database, and use a Cloud NAT instance for internet access.
- C
Assign a public IP address to both the front-end application and the back-end database to ensure accessibility.
- D
Use a private IP address for the front-end application and enable Private Google Access for internet connectivity.
- E
Assign a private IP address to the back-end database and use VPC firewall rules to restrict access.
Show answer and explanation
Correct answers: A, E
Explanation
To meet the requirements of the scenario, the front-end application needs a public IP address to allow internet accessibility. The back-end database, however, should only be accessible internally within the VPC, which requires a private IP address. Additionally, implementing VPC firewall rules for the database adds another layer of security by controlling access to it. This setup ensures a secure and functional deployment of the multi-tier application on Google Cloud.
- A. Correct.
Correct. To allow the front-end application to be accessible over the internet, a public IP address is necessary. For the back-end database, a private IP ensures it remains accessible only within the VPC.
- B. Incorrect.
Incorrect. While assigning private IPs to both resources and using Cloud NAT could work for outbound internet traffic, it would not allow the front-end application to be accessible over the internet.
- C. Incorrect.
Incorrect. Assigning public IPs to both the front-end and the back-end database would expose the database to the internet, which violates the security principle of least privilege.
- D. Incorrect.
Incorrect. A private IP address for the front-end application would not allow direct internet access, even with Private Google Access, as it is designed for accessing Google APIs and services, not general internet traffic.
- E. Correct.
Correct. Assigning a private IP to the back-end database ensures internal-only access. Adding VPC firewall rules provides an additional layer of security by restricting access to the database.