Your organization wants to deploy an internal application named app-1 in VPC-1. The application will consume services from another internal application named app-2 in VPC-2. VPC Network Peering will…

Question

Options

• AAssign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to
• BAssign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-
• CAssign network tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to
• DAssign secure tags to these applications: secure-tag-app-1 to app-1 and secure-tag-app-2 to app-

• A
  9% (3)
• B
  3% (1)
• C
  71% (25)
• D
  17% (6)

Explanation

By assigning network tags (e.g. secure-tag-app-1 on the app-1 instances and secure-tag-app-2 on app-2) and then creating a VPC firewall ingress rule in VPC-2 that only allows traffic from tag secure-tag-app-1 to instances with tag secure-tag-app-2, you get fine-grained microsegmentation across the peered VPCs. You leave the implicit default deny ingress rule in place (so no other sources can reach app-2) and keep the default allow-all egress rule. This approach is the simplest and follows Google’s best practice for tag-based segmentation in VPC Network Peering.

No community discussion yet for this question.