An enterprise is designing a secure three-tier application architecture on Google Cloud across isolated VPC networks for the presentation tier, business logic tier, and database tier. The security team establishes the following boundary isolation requirements: The business logic tier must privately publish microservices to the presentation VPC without creating transitive routing risks, shared IP address spaces, or VPC Network Peering mesh dependencies. Compute Engine instances in the backend tiers must communicate with Google APIs (such as Cloud Storage and BigQuery) privately without public IP addresses or internet egress. Layer 7 traffic routing, path-based URL directing, and TLS termination for internal microservices within a VPC must be fully managed with private addressing. Which combination of network isolation and data encapsulation controls should you deploy?

Deploy Private Service Connect (PSC) endpoints to publish and consume business microservices across VPCs, configure an Internal Application Load Balancer with a proxy-only subnet for Layer 7 internal routing, and enable Private Google Access on the backend subnets.: ### What the Recommended Architecture Is This architecture combines **Private Service Connect (PSC)**, **Internal Application Load Balancers (Envoy-based L7 ILBs)** with dedicated **proxy-only subnets**, and **Private Google Access** to enforce zero-trust boundary segmentation and complete data encapsulation for multi-tier applications. ### How It Meets the Requirements - **Microservice encapsulation without peering**: **Private Service Connect** creates unidirectional, service-oriented endpoints in the consumer VPC mapped to service attachments in the producer VPC. It completely eliminates the need for bidirectional **VPC Network Peering**, preventing lateral transit paths, IP CIDR conflicts, and peering quota limits. - **Private Google API reachability**: Enabling **Private Google Access** on the backend subnets allows VM instances assigned solely RFC 1918 internal IP addresses to route securely to Google APIs (such as **Cloud Storage** and **BigQuery**) across Google's internal software-defined network (SDN) backplane without traversing the public internet. - **Internal Layer 7 traffic routing**: Deploying an **Internal Application Load Balancer** provides regional Layer 7 load balancing, SSL/TLS termination, and path-based routing. The load balancer allocates Envoy proxies within a dedicated **proxy-only subnet** (`purpose=REGIONAL_MANAGED_PROXY`) to handle proxying and header inspection without exposing workload IP addresses. ### Key Advantages and Capabilities - **Decoupled address spaces**: PSC allows producer and consumer VPCs to have overlapping IP address ranges since communication is encapsulated via endpoint forwarding rules. - **Explicit authorization**: Service attachments enable granular consumer accept/reject lists with project-level access controls. - **No transitive exposure**: Protects internal tiers from lateral movement by strictly isolating L4/L7 access to declared service endpoints. - **Zero internet exposure**: Backend data tiers operate without external public IP addresses or NAT gateway egress requirements for Google API consumption. ### Why This Is Optimal This architecture strictly isolates each tier's fault domain and network perimeter while providing line-rate performance and comprehensive Layer 7 traffic management.

Psc Internal Load Balancer N Tier Encapsulation | Professional Cloud Security Engineer

Psc Internal Load Balancer N Tier Encapsulation

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing a secure three-tier application architecture on Google Cloud across isolated VPC networks for the presentation tier, business logic tier, and database tier. The security team establishes the following boundary isolation requirements:

The business logic tier must privately publish microservices to the presentation VPC without creating transitive routing risks, shared IP address spaces, or VPC Network Peering mesh dependencies.
Compute Engine instances in the backend tiers must communicate with Google APIs (such as Cloud Storage and BigQuery) privately without public IP addresses or internet egress.
Layer 7 traffic routing, path-based URL directing, and TLS termination for internal microservices within a VPC must be fully managed with private addressing.

Which combination of network isolation and data encapsulation controls should you deploy?

Deploy Private Service Connect (PSC) endpoints to publish and consume business microservices across VPCs, configure an Internal Application Load Balancer with a proxy-only subnet for Layer 7 internal routing, and enable Private Google Access on the backend subnets.

Deploy multi-NIC VM instances to bridge the tier VPCs, deploy an Internal Passthrough Network Load Balancer for Layer 7 traffic management, and route Google API requests through a custom Router appliance VM.

Configure a VPC Network Peering mesh between all application VPCs, deploy an External Application Load Balancer with Cloud Armor for internal path-based routing, and configure Cloud NAT for Google API egress.

Establish Private Services Access (PSA) using an allocated internal IP range across all tiers, configure classic Cloud VPN tunnels between tier subnets, and assign ephemeral external IP addresses restricted by VPC firewall rules.

Professional Cloud Security Engineer

Psc Internal Load Balancer N Tier Encapsulation

Related questions