Professional Cloud ArchitectDemo

By Google · Question Mode

QuestionQ225

Designing for security and compliance

Your web application runs several VM instances in a VPC. You need to limit communication between instances to only the authorized paths and ports, without depending on static IP addresses or subnets because the application can autoscale. How should you restrict communication?

  • A Use separate VPCs to restrict traffic
  • B Use firewall rules based on network tags attached to the compute instances
  • C Use Cloud DNS and only allow connections from authorized hostnames
  • D Use service accounts and configure the web application to authorize particular service accounts to have access
Explanation

VPC firewall rules can use network tags as source and target selectors, so authorized traffic can be limited by protocol and port between appropriately tagged VM instances. Instances created through autoscaling receive the relevant tags without requiring static IP-address or subnet-based rules.

Community Discussion

No comments yet. Be the first to start the discussion!