Home Microsoft Exams Google Cloud Exams

Loading page

Curious about new developments and updates? Follow our social media.

Get a free certification question every week.

Microsoft Exams

AZ-104 Administrator
AZ-204 Developer
AZ-900 Fundamentals
All Microsoft Exams

Google Cloud Exams

Associate Data Practitioner
All Google Cloud Exams

Terms Privacy Cookies About Pricing

© 2026 StudyCerts. All rights reserved.

StudyCerts is an independent service and is not affiliated with, endorsed by, or sponsored by any certification body or cloud provider.

Loading page

Home
Google Cloud Exams
Professional Cloud Security Engineer
Configuring network isolation and data encapsulation for N-tier applications.
An enterprise operates a sensitive multi-tier financial appl…

Professional Cloud Security Engineer

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Gke Microsegmentation Service Mesh Strict Mtls

Section: Configuring network isolation and data encapsulation for N-tier applications.

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

...

...

...

...

...

Explanations

...

View source documentation

Related questions

Keep the momentum going with these hand-picked practice scenarios

AdvancedProfessional Cloud Security Engineer

An enterprise is designing a secure three-tier application architecture on Google Cloud across isolated VPC networks for the presentation tier, business logic tier, and database tier. The security team establishes the following boundary isolation requirements: The business logic tier must privately publish microservices to the presentation VPC without creating transitive routing risks, shared IP address spaces, or VPC Network Peering mesh dependencies. Compute Engine instances in the backend tiers must communicate with Google APIs (such as Cloud Storage and BigQuery) privately without public IP addresses or internet egress. Layer 7 traffic routing, path-based URL directing, and TLS termination for internal microservices within a VPC must be fully managed with private addressing. Which combination of network isolation and data encapsulation controls should you deploy?

Configuring network isolation and data encapsulation for N-tier applications.

AdvancedProfessional Cloud Security Engineer

An enterprise is architecting a mission-critical, three-tier application (Web, Application, and Database tiers) across dedicated subnets within a Google Cloud Shared VPC. The central security team requires strict boundary segmentation with the following requirements: Communication must be strictly enforced between adjacent tiers only (Web to App, and App to Database), explicitly blocking lateral movement and direct Web-to-Database access. Workload administrators within service projects must be prevented from bypassing network security boundaries by modifying instance-level metadata or network attributes. Policies must be managed centrally by the security organization and enforced consistently across all environments. Which network security design should the enterprise implement to satisfy these requirements?

Configuring network isolation and data encapsulation for N-tier applications.

AdvancedProfessional Cloud Security Engineer

A financial enterprise is designing a centralized logging and compliance architecture across all Google Cloud projects in its organization. The compliance and security teams have established the following requirements: All Admin Activity and Data Access audit logs must be retained for 5 years (1,825 days) to meet regulatory retention mandates. Audit logs must be protected against tampering, early deletion, and unauthorized modification using write-once-read-many (WORM) immutability. Log storage costs must be optimized by automatically transitioning older log data to Coldline storage after 90 days. Security auditors must have read-only access to view the archived log objects without being able to modify access policies or delete data. Which logging and storage strategy should the enterprise implement to satisfy these requirements?

Designing an effective logging strategy.

AdvancedProfessional Cloud Security Engineer

A security engineer is evaluating IAM access across an organization's resource hierarchy structured as follows: Folder: Finance-Dept Project: fin-analytics-prod (child of Finance-Dept) Cloud Storage Bucket: fin-audit-logs (located inside fin-analytics-prod) The following IAM allow policies are currently configured: At the Finance-Dept Folder level, the principal auditor@example.com is granted the Storage Admin (roles/storage.admin) role. At the fin-analytics-prod Project level, auditor@example.com is granted the Storage Object Viewer (roles/storage.objectViewer) role. At the fin-audit-logs Bucket level, a local administrator attempts to restrict access by granting auditor@example.com only the Storage Object Creator (roles/storage.objectCreator) role. What is the effective permission state of auditor@example.com on the fin-audit-logs bucket, and why?

Using the resource hierarchy for access control and permissions inheritance.

AdvancedProfessional Cloud Security Engineer

A financial enterprise deploys custom-trained classification models to Vertex AI to predict sensitive loan outcomes. A cloud security engineer is tasked with establishing security controls across the model deployment pipeline and inference serving layer to meet the following requirements: Model Governance & Integrity: Maintain centralized lifecycle management with distinct versioning in Vertex AI Model Registry, and enforce cryptographic verification of model artifacts prior to deployment to prevent tampering. Privacy & Attack Mitigation: Prevent model inversion and membership inference attacks that attempt to reconstruct private training data from the prediction API responses. Network Isolation: Ensure client workloads within the enterprise Virtual Private Cloud (VPC) reach the inference endpoint privately without routing over the public internet. Which combination of controls should the security engineer implement?

Implementing security and privacy controls for AI/ML systems to protect against unintentional exploitation of data or models.

AdvancedProfessional Cloud Data Engineer

A financial analytics firm is building an event-driven data ingestion pipeline. Whenever transaction batch files are uploaded to a Cloud Storage bucket, the system must immediately trigger an orchestration process that: Reads configuration metadata from Cloud Firestore. Executes a containerized data-cleaning microservice on Cloud Run. Catches specific HTTP errors (such as 404 Not Found) and retries transient service faults with backoff, while raising unhandled exceptions. The organization requires a fully serverless, low-latency solution that minimizes operational management and isolates orchestration logic from business logic. Which architecture should the data engineering team implement to meet these requirements?

Job automation and orchestration (e.g., Cloud Composer and Workflows)

Want more questions like this?

Get a free certification question every week.

Last updated August 28, 2026

Are you ready for the Professional Cloud Security Engineer?

50 questions in the full practice test

More Configuring network isolation and data encapsulation for N-tier applications. practice questions

Get a free certification question with a full explanation every week.

Professional Cloud Security Engineer

Provider: Google Cloud
Passing score: 70%
Questions: 50
Duration: 90 minutes

Other sections in this exam

Configuring access
Securing communications and establishing boundary protection
Ensuring data protection
Managing operations
Supporting compliance requirements

Ask Scout

Still curious? Scout, our AI tutor, can explain this concept further and answer your follow-up questions.

An enterprise operates a sensitive multi-tier financial application running across multiple namespaces on Google Kubernetes Engine (GKE). To comply with a zero-trust security framework, the architecture must satisfy two core requirements:

Cryptographic Data Encapsulation & Identity Verification: All inter-service traffic between application tiers must be authenticated and encrypted in transit using mutual TLS (mTLS), strictly rejecting any unencrypted plaintext connections.
Network-Layer Boundary Segmentation: Microservices must be isolated at Layer 3/Layer 4 (L3/L4) so that workloads can only receive network traffic from designated tier Pods and authorized namespaces, mitigating lateral movement.

Which combination of controls should the security team implement to satisfy these requirements?

Apply a Cloud Service Mesh PeerAuthentication policy configured with PERMISSIVE mode, and configure Google Cloud VPC firewall rules referencing Compute Engine network tags.

Configure Cloud Service Mesh DestinationRule resources with DISABLE TLS mode, and enforce GKE node-to-node IPsec encryption using Cloud VPN tunnels.

Deploy Binary Authorization attestation policies to Pod admission controllers, and configure Google Cloud Armor security policies on internal HTTP(S) Load Balancers.

Apply a Cloud Service Mesh PeerAuthentication policy configured with STRICT mode, and implement Kubernetes NetworkPolicies targeting Pod labels and namespace selectors.

Apply a Cloud Service Mesh PeerAuthentication policy configured with PERMISSIVE mode, and configure Google Cloud VPC firewall rules referencing Compute Engine network tags.

Configure Cloud Service Mesh DestinationRule resources with DISABLE TLS mode, and enforce GKE node-to-node IPsec encryption using Cloud VPN tunnels.

Deploy Binary Authorization attestation policies to Pod admission controllers, and configure Google Cloud Armor security policies on internal HTTP(S) Load Balancers.

Apply a Cloud Service Mesh PeerAuthentication policy configured with STRICT mode, and implement Kubernetes NetworkPolicies targeting Pod labels and namespace selectors.

What the Solution Is

This architecture combines Cloud Service Mesh transport authentication controls with native Kubernetes NetworkPolicy resources to create a defense-in-depth, zero-trust boundary around containerized microservice tiers in GKE.

How It Meets the Requirements

Cryptographic encapsulation and mTLS enforcement: Applying a PeerAuthentication custom resource with spec.mtls.mode: STRICT (either across the mesh in the istio-system root namespace or per workload namespace) ensures that the sidecar proxies mandate mutual TLS. Plaintext traffic and unauthenticated requests are actively blocked at the application/transport layer.
L3/L4 microsegmentation and boundary control: Kubernetes NetworkPolicy objects enforce container-level packet filtering. By leveraging podSelector and namespaceSelector, security teams specify exact ingress and egress whitelists, ensuring that only explicitly authorized Pods can establish network connections to sensitive backend tiers.

Key Advantages and Capabilities

Dual-layer defense: Operates across Layer 3/4 (IP/port packet filtering) and Layer 7 (workload identity verification and cryptographic encryption).
Zero-trust verification: Requires workloads to present cryptographic identity certificates provided by the mesh control plane while disallowing unauthorized lateral movement at the kernel/CNI level.
Automated certificate rotation: Cloud Service Mesh dynamically provisions and rotates x509 certificates to proxy sidecars without code modifications.
Namespace isolation: Enforces boundaries between diverse application tiers deployed across separate Kubernetes namespaces.

Why This Is Optimal

Combining PeerAuthentication in STRICT mode with Kubernetes NetworkPolicies addresses both transport-layer data encapsulation and network-level microsegmentation. It prevents lateral movement from compromised Pods while guaranteeing that all in-flight microservice data is cryptographically secure.