An organization is deploying a multi-region workload in a custom-mode Virtual Private Cloud (VPC) network named `analytics-vpc`. Compute Engine virtual machines without external public IP addresses are located in `us-east4` (tagged `db-backend`) and `europe-west1` (tagged `app-frontend`). The security policy requires that `db-backend` instances accept incoming TCP traffic on port 5432 exclusively from `app-frontend` instances. Additionally, all virtual machines must be able to reach Google Cloud service endpoints without being assigned public IP addresses. Which TWO configuration steps are required to implement this architecture? (Select TWO.)
- Enable Private Google Access on the subnets containing the virtual machines.Answer
- BAssign the IAM primitive role `roles/owner` to the service accounts attached to the instances to automatically grant cross-subnet network access.
- Create an ingress firewall rule specifying target tag `db-backend`, source tag `app-frontend`, protocol TCP, and port 5432 with an allow action.Answer
- DCreate an egress firewall rule with a priority number of 10000 to override default implicit deny rules, assuming higher priority numbers take precedence in evaluation.
Answer
The two required configuration steps are enabling Private Google Access on the subnets and creating an ingress firewall rule targeting 'db-backend' with source tag 'app-frontend' for TCP port 5432.
Enabling Private Google Access on subnets allows VM instances with only private internal IP addresses to reach Google Cloud APIs and services. Creating an ingress firewall rule with target tag 'db-backend' and source tag 'app-frontend' for TCP port 5432 correctly restricts traffic between the front-end and database instances according to security requirements.
Step-by-Step Solution
Key Concept
VPC Subnet Private Google Access & Firewall Network Tag Rules