Exam Professional Cloud Security Engineer topic 1 question 122 discussion

D https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags

The requirement can be fulfilled by both network tags and service accounts. To update both compute instances will have to be stopped. That means options A and B are out. Option C is out because Compute Engine Instance Admins can change network tags and avoid firewall rules. Deployment has to be done based on the instance template so that no configuration can be changed to divert the traffic.

It's D because of it's use of auto-scaling. If autoscaling wasn't part of the question, then B would have been suitable. It can't be network level tags because admins can change those.

Can you create an instance template with a service account? How do you automate that and how does it name the service accounts for each new instance??

D is right

This depends on what is meant by "re-deploy"? Service accounts can also be changed by simply stopping the VM and starting it again once the SA was changed. Is this already a re-deploy?

D. 1. Re-deploy the Web and App servers with instance templates configured with respective service accounts. 2. Create an allow VPC firewall rule that specifies the target/source with respective service accounts.

D is the answer. https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags A service account represents an identity associated with an instance. Only one service account can be associated with an instance. You control access to the service account by controlling the grant of the Service Account User role for other IAM principals. For an IAM principal to start an instance by using a service account, that principal must have the Service Account User role to at least use that service account and appropriate permissions to create instances (for example, having the Compute Engine Instance Admin role to the project).

Agreed, it has to be D https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags