Google Professional Cloud Security Engineer Question 235
Select 3Google Cloud PlatformYour organization is deploying a new web application on Google Cloud. To meet regulatory compliance and minimize the blast radius of potential attacks, you need to configure boundary segmentation for the application. The application consists of a public frontend, a private backend API, and a database. Which of the following actions should you take to properly implement boundary segmentation?
- A
Use separate VPCs for the frontend, backend API, and database, and configure VPC peering.
- B
Use subnet-level segmentation and firewall rules to restrict access between the frontend, backend API, and database.
- C
Configure service accounts with least privilege and use them for communication between application components.
- D
Deploy all components in the same subnet but use IAM policies to restrict access between the frontend and backend.
- E
Implement Private Google Access for the backend API and database to disable public IP access.
Show answer and explanation
Correct answers: B, C, E
Explanation
Boundary segmentation is a critical aspect of securing applications on Google Cloud. Subnet-level segmentation and firewall rules provide network-level isolation, while service accounts with least privilege enforce identity-based access controls. Additionally, enabling Private Google Access ensures that sensitive components like the backend API and database are not exposed to the public internet. Together, these measures minimize the blast radius of potential attacks and help meet regulatory compliance.
- A. Incorrect.
Using separate VPCs can add unnecessary complexity and may not be required for boundary segmentation in this scenario. VPC peering also does not inherently restrict access between components.
- B. Correct.
Subnet-level segmentation and firewall rules are effective for boundary segmentation because they enforce network-level isolation and restrict access based on IP ranges and protocols.
- C. Correct.
Service accounts with least privilege ensure that only specific components can communicate with each other, which strengthens boundary security on an identity-based level.
- D. Incorrect.
Deploying all components in the same subnet does not provide sufficient segmentation, as IAM policies alone cannot enforce network-level isolation.
- E. Correct.
Private Google Access helps ensure that the backend API and database are not accessible over public IPs, which is critical for minimizing the attack surface.