Google
ASSOCIATE-CLOUD-ENGINEER · Question #263
You have two subnets (subnet-a and subnet-b) in the default VPC. Your database servers are running in subnet-a. Your application servers and web servers are running in subnet-b. You want to…
The correct answer is A. - Create service accounts sa-app and sa-db. Both service accounts and network tags can be used for creating a Cloud Firewall rule. The prime word is "to allow network traffic from app server to database server" which is achievable by inbound/ingress rule and not egress rule…
Submitted by tunde_lagos· Mar 30, 2026Configuring access and security
Question
You have two subnets (subnet-a and subnet-b) in the default VPC. Your database servers are running in subnet-a. Your application servers and web servers are running in subnet-b. You want to configure a firewall rule that only allows database traffic from the application servers to the database servers. What should you do?
Options
- A
- Create service accounts sa-app and sa-db.
- B
- Create network tags app-server and db-server.
- C
- Create a service account sa-app and a network tag db-server.
- D
- Create a network tag app-server and service account sa-db.
How the community answered
(37 responses)- A68% (25)
- B5% (2)
- C19% (7)
- D8% (3)
Explanation
Both service accounts and network tags can be used for creating a Cloud Firewall rule. The prime word is "to allow network traffic from app server to database server" which is achievable by inbound/ingress rule and not egress rule. https://cloud.google.com/firewall/docs/firewalls#rule_assignment
Topics
#VPC firewall rules#service accounts#network tags#least privilege
Community Discussion
No community discussion yet for this question.