Google Cloud Professional Cloud Security Engineer Practice Exam

How can authenticated network separation be achieved for different tiers of a 3-tier web application on Compute Engine?

1. Run each tier with a different Service Account and use Service Account-based firewall rules

2. Utilize a single Service Account for all tiers and enable SSL

3. Implement a Virtual Private Cloud (VPC) for each application tier

4. Deploy each tier in separate regions

The correct answer is: Run each tier with a different Service Account and use Service Account-based firewall rules

Authenticated network separation can be effectively achieved by running each tier of a 3-tier web application with a different Service Account and implementing Service Account-based firewall rules. This approach provides a granular level of security and access control tailored to the requirements of each application tier. By assigning unique Service Accounts for each tier, distinct identities and permissions are established, allowing for more precise definition and enforcement of security policies. Service Account-based firewall rules can then be applied to restrict communication between the tiers, ensuring that only authorized traffic is permitted. This means that, for example, the front-end tier can only communicate with the back-end tier through explicit rules that recognize the Service Account’s identity, thus providing authenticated separation. Utilizing a single Service Account across all tiers would not provide the necessary separation and could lead to unrestricted access, while implementing a separate Virtual Private Cloud (VPC) for each tier could increase complexity and management overhead without the benefits of authenticated identity management. Deploying each tier in separate regions does not inherently provide network separation; it simply distributes the application across geographical locations without addressing authentication and access control. Therefore, the most effective strategy in this context is to utilize different Service Accounts combined with Service Account-based firewall rules to achieve authenticated network separation.