Google Professional Cloud Security Engineer Question 249
Select 2Google Cloud PlatformYou are designing a 3-tier application on Google Cloud that consists of a web tier, an application tier, and a database tier. To enhance security, you need to configure network isolation and ensure that communication between tiers is encapsulated to reduce the attack surface. Which of the following configurations should you implement?
- A
Use separate VPCs for each tier and configure VPC Peering for communication between them.
- B
Create separate subnets for each tier within the same VPC and enforce firewall rules to restrict communication.
- C
Use Private Google Access to ensure that tiers communicate securely without exposing traffic to the public internet.
- D
Use Shared VPC to host all tiers, and implement custom IAM roles to control inter-tier communication.
- E
Enable VPC Service Controls to define security perimeters for sensitive data and restrict communication between tiers.
Show answer and explanation
Correct answers: B, C
Explanation
To configure network isolation and data encapsulation for an N-tier application, separate subnets within the same VPC provide logical segmentation and enforce isolation through firewall rules. Private Google Access ensures secure communication over Google's private network, reducing exposure to external threats. These configurations together enhance security without adding unnecessary complexity.
- A. Incorrect.
Using separate VPCs for each tier with VPC Peering can increase complexity and is not necessary for N-tier applications. Subnets within the same VPC are sufficient for network isolation.
- B. Correct.
Creating separate subnets for each tier within the same VPC allows logical segmentation of resources. Firewall rules can be applied to control inter-tier communication, ensuring secure and isolated connections.
- C. Correct.
Private Google Access ensures that communication between the application tiers happens over Google's private network rather than the public internet, reducing the attack surface.
- D. Incorrect.
Shared VPC is useful for managing resources across multiple projects but does not inherently enforce isolation or encapsulation for N-tier applications.
- E. Incorrect.
VPC Service Controls are designed to define security perimeters around APIs and services, not for inter-tier communication within an N-tier application.