QuestionQ286

Securing communications and establishing boundary protection

You are responsible for migrating a legacy application from your company data centers to GCP before the existing maintenance contract expires. You do not know which ports the application uses, and no documentation is available to review. You want to complete the migration without placing your environment at risk.

What should you do?

  • A Migrate the application into an isolated project using a ג€Lift & Shiftג€ approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
  • B Migrate the application into an isolated project using a ג€Lift & Shiftג€ approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.
  • C Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
  • D Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project. Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
Explanation

A lift-and-shift deployment in an isolated project contains the legacy workload while preserving its existing behavior. Temporarily permitting internal TCP connectivity lets its components operate, and VPC Flow Logs provide visibility into the observed network flows so precise, least-privilege firewall rules can be created afterward. VPC Flow Logs sample TCP traffic to and from VM instances and are intended for network monitoring and diagnosis.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!