nerdexam
Google

ASSOCIATE-CLOUD-ENGINEER · Question #30

Your company has a 3-tier solution running on Compute Engine. The configuration of the current infrastructure is shown below. Each tier has a service account that is associated with all instances with

The correct answer is B. 1. Create an ingress firewall rule with the following settings:. The question requires configuring Google Compute Engine firewall rules to allow specific ingress communication on TCP port 8080 between three application tiers, using service accounts for identification.

Submitted by dimitri_ru· Mar 30, 2026Configuring access and security

Question

Your company has a 3-tier solution running on Compute Engine. The configuration of the current infrastructure is shown below. Each tier has a service account that is associated with all instances within it. You need to enable communication on TCP port 8080 between tiers as follows: - Instances in tier #1 must communicate with tier #2. - Instances in tier #2 must communicate with tier #3. What should you do?

Exhibit

ASSOCIATE-CLOUD-ENGINEER question #30 exhibit

Options

  • A
    1. Create an ingress firewall rule with the following settings:
  • B
    1. Create an ingress firewall rule with the following settings:
  • C
    1. Create an ingress firewall rule with the following settings:
  • D
    1. Create an egress firewall rule with the following settings:

How the community answered

(46 responses)
  • A
    7% (3)
  • B
    48% (22)
  • C
    30% (14)
  • D
    15% (7)

Why each option

The question requires configuring Google Compute Engine firewall rules to allow specific ingress communication on TCP port 8080 between three application tiers, using service accounts for identification.

A1. Create an ingress firewall rule with the following settings:

This option would likely have incorrect target/source combinations or port settings compared to the specific communication requirements.

B1. Create an ingress firewall rule with the following settings:Correct

To allow Tier #1 to communicate with Tier #2, an ingress firewall rule must target Tier #2 instances (via their service account) with Tier #1 instances (via their service account) as the source. Similarly, to allow Tier #2 to communicate with Tier #3, another ingress rule must target Tier #3 instances with Tier #2 instances as the source, both specified for TCP port 8080.

C1. Create an ingress firewall rule with the following settings:

This option would likely have incorrect target/source combinations or port settings, failing to match the explicit communication flow needed.

D1. Create an egress firewall rule with the following settings:

Egress firewall rules control outgoing traffic, but the requirement is to allow *incoming* communication to Tier #2 and Tier #3, making ingress rules the correct approach.

Concept tested: Compute Engine ingress firewall rules with service accounts

Source: https://cloud.google.com/vpc/docs/firewalls

Topics

#firewall rules#service accounts#ingress rules#3-tier architecture

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full ASSOCIATE-CLOUD-ENGINEER Practice