Google Associate Cloud Engineer

Get started today

Ultimate access to all questions.

Explanation:

Option A is correct because it utilizes service accounts to precisely control access between the application and database servers. By associating the sa-app service account with the application servers and the sa-db service account with the database servers, you can ensure that only traffic from the application servers (source service account sa-app) is permitted to reach the database servers (target service account sa-db). An ingress firewall rule is then created to specifically allow this traffic. Options B, C, and D are incorrect as they either use network tags inappropriately for access control or fail to restrict traffic adequately between the specified servers. For more information, refer to Google Cloud's documentation on service accounts and firewall rules.

Explanation:

Comments (0)

No comments yet.

You have developed a 2-tier application on Google Cloud, consisting of an application tier and a database tier. The application tier operates in subnet-a, while the database tier is in subnet-b, both within the default VPC. What is the best method to configure a firewall rule that ensures only the application servers can communicate with the database servers?

Real Exam

Create two service accounts named sa-app and sa-db. 2. Assign the sa-app service account to the application tier servers and the sa-db service account to the database tier servers. 3. Implement an ingress firewall rule to permit network traffic from the source service account sa-app to the target service account sa-db.

35.7%

Apply a network tag 'app-server' to the application servers and 'db-server' to the database servers. 2. Establish an egress firewall rule to allow network traffic from the source network tag 'app-server' to the target network tag 'db-server'.

42.9%

Generate a service account sa-app and a network tag 'db-server'. 2. Link the sa-app service account to the application servers and the 'db-server' network tag to the database servers. 3. Create an ingress firewall rule to allow network traffic from all VPC IP addresses to the subnet-a IP addresses.

14.3%

Powered ByGPT 5.4 powered

Create a network tag 'app-server' and a service account sa-db. 2. Attach the 'app-server' tag to the application servers and associate the sa-db service account with the database servers. 3. Set up an egress firewall rule to permit network traffic from the source network tag 'app-server' to the target service account sa-db.