Professional Cloud Architect · Free Practice Question Hard
Question 35
Your organization runs a multi-tier e-commerce application in Google Cloud, with separate tiers for the frontend, business logic, and backend database. All tiers are deployed in the same VPC, but each is in its own subnetwork. You need to ensure that:
The frontend tier can only communicate with the business logic tier.
The business logic tier can only communicate with both the frontend and the backend database tier.
The backend database tier cannot initiate communication to other tiers.
What is the most effective way to configure the network with minimal administrative overhead?
-
A
Add tags to each tier and set up firewall rules to allow the desired traffic flow.
-
B
Use hierarchical firewall policies to block all traffic and explicitly allow only the required flows.
-
C
Add tags to each tier and create a default-allow ingress rule for all tiers.
-
D
Configure routes to restrict traffic flow between the tiers based on their subnetworks.
Reveal correct answer
Correct answer: A
A.
Adding tags to each tier and configuring firewall rules ensures granular control over network traffic. Tags allow you to create flexible and reusable rules that can be applied based on the logical roles of the tiers, making it easier to maintain and scale. Firewall rules can be defined to allow traffic specifically from one tier to another while blocking unintended flows.
B.
While hierarchical policies can manage network flows at scale, they are typically used for organizational-level control. For a single VPC with clear tier boundaries, regular firewall rules are simpler and sufficient.
C.
Default-allow ingress rules open unrestricted access between tiers, violating the principle of least privilege. This does not ensure the required traffic restrictions between tiers.
D.
Routes in Google Cloud control packet forwarding, not security. They cannot enforce restrictions based on IP or tier. Traffic would still require firewall rules for proper control.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
