nerdexam
Google

PROFESSIONAL-CLOUD-ARCHITECT · Question #359

You are deploying a new three-tier application to Compute Engine instances within a single Virtual Private Cloud (VPC). The architecture is segmented into three subnets: a web tier subnet, an applicat

The correct answer is C. Use a combination of network tags and service accounts. Apply a unique network tag and a. Using network tags and/or service accounts to scope firewall rules is the recommended way to enforce least-privilege traffic flows within a VPC. By assigning distinct tags and service accounts per tier, you can create precise ingress rules that only allow traffic from the upstrea

Submitted by helene.fr· Mar 30, 2026Designing for security and compliance

Question

You are deploying a new three-tier application to Compute Engine instances within a single Virtual Private Cloud (VPC). The architecture is segmented into three subnets: a web tier subnet, an application tier subnet, and a database tier subnet. - The web tier must only receive traffic from an external load balancer. - The application tier must only receive traffic from the web tier. - The database tier must only receive traffic from the application tier. You need to enforce strict traffic flow control and want to follow Google-recommended practices. What should you do?

Options

  • AConfigure Cloud NAT for each subnet, and create Google Cloud Armor policies to filter traffic
  • BCreate a single VPC firewall rule with a high priority that allows ingress traffic on all ports between
  • CUse a combination of network tags and service accounts. Apply a unique network tag and a
  • DSet up VPC Network Peering between the web tier and application tier subnets, and another

How the community answered

(18 responses)
  • A
    11% (2)
  • B
    11% (2)
  • C
    72% (13)
  • D
    6% (1)

Explanation

Using network tags and/or service accounts to scope firewall rules is the recommended way to enforce least-privilege traffic flows within a VPC. By assigning distinct tags and service accounts per tier, you can create precise ingress rules that only allow traffic from the upstream tier and block all other sources, ensuring the web tier only accepts load balancer traffic, the app tier only accepts web-tier traffic, and the database tier only accepts app-tier traffic.

Topics

#VPC firewall rules#network tags#service accounts#traffic segmentation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-ARCHITECT Practice