Google Professional Cloud Security Engineer Question 209
Select 3Google Cloud PlatformYou are designing a Google Cloud architecture for a web application. The application needs to expose an API endpoint to users over the internet while ensuring database servers remain accessible only within a private network. Which of the following configurations ensures proper use of public and private IP addresses in this scenario?
- A
Assign public IP addresses to the database servers to allow external access.
- B
Assign private IP addresses to the database servers and use a VPC to control access.
- C
Assign a public IP address to the API endpoint and configure a firewall rule to allow traffic from the necessary IP ranges.
- D
Use a Cloud NAT to allow the database servers to access the internet without exposing their private IPs.
- E
Assign private IP addresses to the API endpoint to ensure it is not exposed to the public internet.
Show answer and explanation
Correct answers: B, C, D
Explanation
In this scenario, the database servers should use private IP addresses to remain secure within the private network. A VPC and Cloud NAT can further enhance their security while still allowing necessary outbound connections. The API endpoint, on the other hand, must have a public IP address to be accessible over the internet. Properly configuring firewall rules ensures only authorized traffic can reach the API endpoint.
- A. Incorrect.
Assigning public IP addresses to the database servers would expose them to the internet, which violates the principle of least privilege and creates a significant security risk.
- B. Correct.
Assigning private IP addresses to the database servers and using a Virtual Private Cloud (VPC) to control access ensures that the database servers are not directly exposed to the public internet and remain secure within the private network.
- C. Correct.
Assigning a public IP address to the API endpoint makes it accessible over the internet, which is required for users to interact with the application. Configuring a firewall rule ensures only authorized traffic can access the endpoint.
- D. Correct.
Using a Cloud NAT allows the database servers to initiate outbound internet connections (e.g., for updates or external API calls) without exposing their private IPs to the internet, maintaining their security.
- E. Incorrect.
Assigning private IP addresses to the API endpoint would prevent users from accessing it over the internet, which conflicts with the requirement to expose the API endpoint publicly.