Google
PROFESSIONAL-CLOUD-ARCHITECT · Question #127
Your web application has several VM instances running within a VPC. You want to restrict communications between instances to only the paths and ports you authorize, but you don't want to rely on…
The correct answer is B. Use firewall rules based on network tags attached to the compute instances. This answer avoids using IP, which are replaced by tags.
Submitted by noor.lb· Mar 30, 2026Designing for security and compliance
Question
Your web application has several VM instances running within a VPC. You want to restrict communications between instances to only the paths and ports you authorize, but you don't want to rely on static IP addresses or subnets because the app can autoscale. How should you restrict communications?
Options
- AUse separate VPCs to restrict traffic
- BUse firewall rules based on network tags attached to the compute instances
- CUse Cloud DNS and only allow connections from authorized hostnames
- DUse service accounts and configure the web application particular service accounts to have
How the community answered
(26 responses)- A4% (1)
- B81% (21)
- C4% (1)
- D12% (3)
Explanation
This answer avoids using IP, which are replaced by tags.
Topics
#firewall rules#network tags#VPC#dynamic autoscaling security
Community Discussion
No community discussion yet for this question.