Exam Associate Cloud Engineer All Questions

View all questions & answers for the Associate Cloud Engineer exam

Exam Associate Cloud Engineer topic 1 question 206 discussion

Actual exam question from Google's Associate Cloud Engineer

Question #: 206
Topic #: 1

[All Associate Cloud Engineer Questions]

You have two subnets (subnet-a and subnet-b) in the default VPC. Your database servers are running in subnet-a. Your application servers and web servers are running in subnet-b. You want to configure a firewall rule that only allows database traffic from the application servers to the database servers. What should you do?

A. • Create service accounts sa-app and sa-db.
• Associate service account sa-app with the application servers and the service account sa-db with the database servers.
• Create an ingress firewall rule to allow network traffic from source service account sa-app to target service account sa-db.
B. • Create network tags app-server and db-server.
• Add the app-server tag to the application servers and the db-server tag to the database servers.
• Create an egress firewall rule to allow network traffic from source network tag app-server to target network tag db-server.
C. • Create a service account sa-app and a network tag db-server.
• Associate the service account sa-app with the application servers and the network tag db-server with the database servers.
• Create an ingress firewall rule to allow network traffic from source VPC IP addresses and target the subnet-a IP addresses.
D. • Create a network tag app-server and service account sa-db.
• Add the tag to the application servers and associate the service account with the database servers.
• Create an egress firewall rule to allow network traffic from source network tag app-server to target service account sa-db.

Show Suggested Answer

Suggested Answer: A 🗳️

by georgesouzafarias at June 23, 2023, 6:38 p.m.

Comments

Submit Cancel

scanner2

Highly Voted 1 year, 11 months ago

Selected Answer: A

Both service accounts and network tags can be used for creating a Cloud Firewall rule. The prime word is "to allow network traffic from app server to database server" which is achievable by inbound/ingress rule and not egress rule. https://cloud.google.com/firewall/docs/firewalls#rule_assignment

upvoted 7 times

...

Captain1212

Highly Voted 1 year, 11 months ago

Selected Answer: A

Answer A is correct as question demands traffic to application to database which can be only be achieved by the ingreess rule

upvoted 5 times

...

peterwheat

Most Recent 2 months, 3 weeks ago

Selected Answer: A

why not B? Due to you are not able to specify network tags as source filter for egress rules.

upvoted 1 times

...

Enamfrancis

10 months, 3 weeks ago

Selected Answer: A

A IS CORRECT

upvoted 1 times

...

Ciupaz

11 months ago

Selected Answer: B

By specifying the source and target tags in the firewall rule, you can ensure that only traffic from instances with the app-server tag can reach instances with the db-server tag.

upvoted 1 times

...

MariaDoss

1 year, 8 months ago

Selected Answer: A

the answer is A

upvoted 2 times

...

GP123123

1 year, 9 months ago

for "allow" rules, restrict them to only allow specific virtual machines by specifying the virtual machine's service account Refer to https://cloud.google.com/firewall/docs/firewalls

upvoted 3 times

GP123123

1 year, 9 months ago

Answer is A

upvoted 2 times

...

carlalap

1 year, 9 months ago

Answer is B. Network tags can be simpler to manage, especially if the access control is based on broader categories (like application servers and database servers) rather than individual instances. If you need fine-grained control and identity-based access, go with service accounts. If you prefer simplicity and broader categorization, network tags may be a suitable choice.

upvoted 2 times

carlalap

1 year, 9 months ago

Although what was previously stated is correct, I must correct it. The correct answer would be option A. Creating an ingress firewall rule on the subnet where your database servers are located is the appropriate approach. This rule would control incoming traffic to the database servers, ensuring that only traffic from the specified application servers (identified by network tags or service accounts) is allowed.

upvoted 2 times

...