PCSE Question 61

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Why B is Correct: Authenticated Separation: Service accounts are tied to IAM policies and can be used to authenticate requests between tiers. They are access-controlled and cannot be modified dynamically while a VM is running, providing stronger guarantees for isolation. Firewall Rules with Service Accounts: Google Cloud supports using service accounts as targets for firewall rules. This ensures that traffic can only flow to VMs with specific service accounts, effectively creating authenticated boundaries between tiers.

• Chose D1

  VM tags in Google Cloud are a flexible way to categorize and identify virtual machines (VMs) by their function or purpose, such as "frontend," "backend," or "database" for a 3-tier application. By assigning each tier its own tag and applying tag-based firewall rules, the customer can enforce network separation and restrict communication between tiers based on tags. This approach provides authenticated network segmentation by allowing or denying traffic between specific tags, ensuring that only intended communications occur between application tiers.

• 1

  Ans :C the question asks for network separation. In case of B, all the tiers are still in the same subnet but are isolated using SA or tags, however, with C, you clearly are separating the network. Hence my answer is C