Google Professional Cloud Security Engineer Question 251
Select 3Google Cloud PlatformYou are designing a three-tier application on Google Cloud consisting of a web front-end, application layer, and database layer. Each layer must be isolated to reduce the attack surface while allowing only necessary communication between tiers. Which of the following configurations should you implement to enforce network isolation and secure data encapsulation?
- A
Create a separate VPC network for each tier and use VPC Network Peering to enable communication between them.
- B
Host each tier in its own subnet within a single VPC and use firewall rules to restrict traffic between subnets.
- C
Use Shared VPC and allocate a separate project for each tier to provide administrative isolation.
- D
Configure private Google access for each subnet to restrict internet access while allowing access to Google APIs.
- E
Enable default firewall rules in the VPC to simplify management and allow unrestricted communication.
Show answer and explanation
Correct answers: B, C, D
Explanation
To enforce network isolation and data encapsulation for N-tier applications, it is best to use subnets within a single VPC with firewall rules to control traffic, Shared VPC for administrative isolation, and private Google access to restrict internet exposure. These configurations ensure minimal attack surface, secure communication, and compliance with security best practices.
- A. Incorrect.
Creating separate VPC networks for each tier is not recommended because it adds unnecessary complexity and VPC Network Peering does not enforce fine-grained traffic controls, such as firewall rules, between tiers.
- B. Correct.
Using subnets within a single VPC and applying firewall rules is a best practice for isolating tiers and restricting traffic to only what is necessary between them.
- C. Correct.
Shared VPC with separate projects for each tier can improve administrative isolation and simplify managing permissions and policies for different teams.
- D. Correct.
Private Google access ensures resources in subnets can access Google APIs securely without exposing them to the internet, adding an extra layer of security.
- E. Incorrect.
Default firewall rules allow overly permissive communication (e.g., unrestricted internal traffic), which violates the principle of least privilege and reduces security.