In your project my-project, you have two subnets in a Virtual Private Cloud (VPC): subnet-a with IP range 10.128.0.0/20 and subnet-b with IP range 172.16.0.0/24. You need to deploy database servers…

Question

Options

• ACreate network tag app-server and service account [email protected].
• BCreate service accounts [email protected] and sa-db@my-
• CCreate service accounts [email protected] and sa-db@my-
• DCreate network tags app-server and db-server.

• A
  17% (6)
• B
  71% (25)
• C
  3% (1)
• D
  9% (3)

Explanation

Using service accounts as firewall rule identifiers is the most secure and recommended approach. Service accounts are cryptographic identities assigned to VMs; only VMs explicitly running as sa-app can send traffic to VMs running as sa-db. This prevents privilege escalation because a user cannot simply add a tag to a VM to gain access - they would need the IAM permission to assign the service account. Option A is weaker because it uses a network tag for the source (application servers), and network tags can be added by anyone with compute.instances.setTags permission, making the rule less secure. Option D uses only network tags for both sides, which is the least secure option. The consistent use of service accounts on both ends in option B provides the strongest identity-based access control.

No community discussion yet for this question.