Professional Cloud Security EngineerDemo

Question

A customer plans to deploy a large number of three-tier web applications on Compute Engine.

How should the customer provide authenticated network separation among the application's different tiers?

A Run each tier in its own Project, and segregate using Project labels.
B Run each tier with a different Service Account (SA), and use SA-based firewall rules.
C Run each tier in its own subnet, and use subnet-based firewall rules.
D Run each tier with its own VM tags, and use tag-based firewall rules.

Explanation

Compute Engine VPC firewall rules can use service accounts to identify source and target VM instances, enforcing tier-to-tier access based on authenticated workload identity. This provides identity-based network separation that subnet-, label-, and ordinary network-tag-based rules do not provide.

Learn more

Professional Cloud Security EngineerDemo

AstroTutor

Notes

Readiness

QuestionQ90

Community Discussion