Google Professional Cloud Security Engineer Question 234
Select 3Google Cloud PlatformYou are designing a multi-tier application on Google Cloud and need to enforce boundary segmentation for security purposes. The application consists of a frontend, a backend, and a database, each running in separate VPC networks. Which actions should you take to implement effective boundary segmentation while allowing communication only where necessary?
- A
Use VPC Network Peering to connect the frontend, backend, and database networks.
- B
Create firewall rules to allow traffic between the frontend and backend only on required ports.
- C
Use Shared VPC to host all tiers in the same network and apply IAM permissions to control access.
- D
Apply hierarchical firewall policies to restrict egress traffic from the backend to only the database.
- E
Use Cloud NAT for the backend and database to access the internet securely without external IPs.
Show answer and explanation
Correct answers: B, D, E
Explanation
Boundary segmentation involves isolating components of an application to enforce least privilege and reduce the attack surface. In this scenario, creating precise firewall rules (Option 2), applying hierarchical policies to control egress traffic (Option 4), and using Cloud NAT to secure internet access without external IPs (Option 5) implement robust segmentation practices. VPC Network Peering (Option 1) and Shared VPC (Option 3) can connect networks but do not inherently enforce segmentation or boundary control.
- A. Incorrect.
Using VPC Network Peering would allow unrestricted communication between the networks, which does not align with the principle of boundary segmentation.
- B. Correct.
Creating firewall rules to allow traffic only on required ports between the frontend and backend adheres to the principle of least privilege and ensures boundary segmentation.
- C. Incorrect.
Using Shared VPC centralizes network management but does not inherently provide boundary segmentation. Instead, it consolidates resources into a single network, which could reduce segmentation effectiveness.
- D. Correct.
Applying hierarchical firewall policies to restrict egress traffic from the backend ensures that the backend can only communicate with the database, maintaining proper boundary segmentation.
- E. Correct.
Using Cloud NAT for secure internet access without external IPs minimizes exposure and adheres to the principle of boundary segmentation by keeping resources private.