Google Professional Cloud Security Engineer Question 247
Select 2Google Cloud PlatformYou are designing a highly secure N-tier application on Google Cloud. The application consists of a frontend web tier, a business logic tier, and a database tier. To ensure proper network isolation and encapsulation of data flow between tiers, which actions should you take?
- A
Use VPC firewall rules to restrict traffic between tiers to only the necessary protocols and ports.
- B
Place each tier in a separate VPC and use VPC Peering to allow communication between them.
- C
Assign each tier to a separate subnet within the same VPC and use private IP ranges for communication.
- D
Enable Private Google Access for all tiers to ensure secure communication with Google APIs.
- E
Deploy each tier in a separate project to enforce strict resource isolation.
Show answer and explanation
Correct answers: A, C
Explanation
To properly configure network isolation and data encapsulation for N-tier applications, it's essential to limit communication between tiers to the necessary protocols and ports using VPC firewall rules. Additionally, placing each tier in separate subnets within the same VPC ensures logical isolation and secure communication using private IP ranges. Other options, while potentially useful in some scenarios, are either unnecessary or do not directly address the requirements for this specific use case.
- A. Correct.
Using VPC firewall rules to restrict traffic between tiers ensures that only authorized protocols and ports are used for communication, which is critical for network isolation and security.
- B. Incorrect.
Placing each tier in a separate VPC and using VPC Peering is unnecessary for most deployments. VPC Peering does not inherently provide better isolation than using subnets within a single VPC.
- C. Correct.
Assigning each tier to a separate subnet within the same VPC and using private IP ranges ensures logical isolation and secure communication within the VPC.
- D. Incorrect.
Enabling Private Google Access is useful for accessing Google APIs securely, but it does not address network isolation or data encapsulation between application tiers.
- E. Incorrect.
Deploying each tier in a separate project is excessive and does not provide significant benefits for N-tier application isolation in most cases. It also increases management complexity unnecessarily.