Google Professional Cloud Security Engineer Question 248
Select 3Google Cloud PlatformYou are designing a secure multi-tier application on Google Cloud. The application has three tiers: a public-facing web tier, an application tier, and a database tier. Each tier requires strict network isolation, and the web tier must only accept traffic from the internet over HTTPS. Additionally, the application tier should only communicate with the web tier, and the database tier should only be accessible by the application tier. Which configuration steps should you implement to meet these requirements?
- A
Create separate VPC subnets for each tier and use VPC firewall rules to control traffic between them.
- B
Use Cloud Load Balancing to route traffic between the tiers and enforce security policies.
- C
Restrict ingress traffic to the web tier subnet to only allow HTTPS traffic from 0.0.0.0/0.
- D
Set up private Google Access to secure communication between the tiers.
- E
Create firewall rules to allow only the application tier to access the database tier on the required port.
Show answer and explanation
Correct answers: A, C, E
Explanation
To achieve network isolation and data encapsulation for an N-tier application, you should use separate subnets for each tier with specific VPC firewall rules to control allowed traffic. The web tier should have restricted ingress traffic for HTTPS from the internet, while communication between other tiers (e.g., application and database) should be tightly controlled using firewall rules to allow only the necessary traffic. Cloud Load Balancing and Private Google Access do not directly address these requirements.
- A. Correct.
Correct: Creating separate VPC subnets for each tier is a best practice for network isolation. VPC firewall rules help enforce strict traffic control between tiers.
- B. Incorrect.
Incorrect: Cloud Load Balancing is used for distributing traffic to services, not for routing traffic between tiers or enforcing network isolation at the subnet level.
- C. Correct.
Correct: Restricting ingress traffic to the web tier to only allow HTTPS traffic from 0.0.0.0/0 ensures secure public access to the web tier.
- D. Incorrect.
Incorrect: Private Google Access is used to allow private instances in a VPC to access Google APIs or services, but it does not isolate or secure communication between application tiers.
- E. Correct.
Correct: Creating specific firewall rules to restrict access to the database tier to only the application tier on the required port ensures secure communication and access control.