Google Professional Cloud Security Engineer Question 239
Select 3Google Cloud PlatformYour organization is designing a multi-tier application in Google Cloud consisting of a public-facing web tier, an application logic tier, and a database tier. To ensure proper boundary segmentation, which of the following configurations should you implement to enhance security and enforce separation of concerns?
- A
Create separate VPC networks for each tier and use VPC Network Peering to enable communication between tiers.
- B
Use subnets to segment each tier within a single VPC and apply firewall rules to restrict traffic between the tiers.
- C
Configure private Google Access to ensure communication between tiers remains within the Google network.
- D
Deploy each tier in a separate project and use Shared VPC to control access and communication across the projects.
- E
Implement service accounts with least privilege and IAM roles specific to each tier's needs.
Show answer and explanation
Correct answers: B, D, E
Explanation
Boundary segmentation is a key aspect of securing multi-tier applications in Google Cloud. By using subnets within a single VPC and applying firewall rules, or deploying each tier in separate projects with Shared VPC, you can enforce isolation and control communication. Additionally, configuring service accounts with least privilege ensures that permissions are tightly scoped to each tier's needs, further enhancing segmentation. These practices collectively help reduce the attack surface and improve security.
- A. Incorrect.
Creating separate VPC networks for each tier and using VPC Network Peering can be overly complex and is not necessary for most applications. Subnet segmentation within a single VPC is generally sufficient for multi-tier applications.
- B. Correct.
Using subnets to segment each tier within a single VPC and applying firewall rules is a best practice to enforce boundary segmentation while maintaining simplicity in network design.
- C. Incorrect.
Private Google Access is used to allow instances without public IPs to access Google APIs and services, but it does not directly enforce boundary segmentation between application tiers.
- D. Correct.
Deploying each tier in separate projects and using Shared VPC allows for better administrative control and isolation while still enabling secure communication across tiers. This is a highly recommended approach for large-scale environments.
- E. Correct.
Implementing service accounts with least privilege and IAM roles specific to each tier ensures that each tier only has the permissions necessary for its function, supporting security through separation of concerns.