Answer-first summary for fast verification
Answer: Migrate the application into an isolated project using a ג€Lift & Shiftג€ approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
The question requires migrating a legacy application with unknown ports and no documentation while avoiding security risks. Option A is optimal because it uses a 'Lift & Shift' approach, which is practical given the time constraint (maintenance contract expiry). Enabling all internal TCP traffic initially allows the application to function post-migration, while VPC Flow logs help identify necessary traffic patterns without exposing the environment externally. This balances functionality and security by isolating the project and using logs to refine rules. Option B is less suitable because disabling all VPC traffic would prevent the application from working initially, causing disruption and making it impossible to gather meaningful log data. Options C and D involve refactoring (to microservices or Cloud Functions), which is time-consuming, risky without application knowledge, and contradicts the 'Lift & Shift' requirement for a legacy system with a deadline. Community consensus (e.g., high upvotes for A, comments highlighting B's disruption and the need for VPC Flow logs over Firewall logs) supports A as the secure and feasible choice.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
You are migrating a legacy application from an on-premises data center to Google Cloud Platform (GCP) before its maintenance contract expires. The application's required network ports are unknown, and no documentation exists. How do you perform this migration without introducing security risks to your environment?
A
Migrate the application into an isolated project using a ג€Lift & Shiftג€ approach. Enable all internal TCP traffic using VPC Firewall rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
B
Migrate the application into an isolated project using a ג€Lift & Shiftג€ approach in a custom network. Disable all traffic within the VPC and look at the Firewall logs to determine what traffic should be allowed for the application to work properly.
C
Refactor the application into a micro-services architecture in a GKE cluster. Disable all traffic from outside the cluster using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.
D
Refactor the application into a micro-services architecture hosted in Cloud Functions in an isolated project. Disable all traffic from outside your project using Firewall Rules. Use VPC Flow logs to determine what traffic should be allowed for the application to work properly.