Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
An enterprise is designing a secure three-tier application architecture on Google Cloud across isolated VPC networks for the presentation tier, business logic tier, and database tier. The security team establishes the following boundary isolation requirements:
Which combination of network isolation and data encapsulation controls should you deploy?
This architecture combines Private Service Connect (PSC), Internal Application Load Balancers (Envoy-based L7 ILBs) with dedicated proxy-only subnets, and Private Google Access to enforce zero-trust boundary segmentation and complete data encapsulation for multi-tier applications.
purpose=REGIONAL_MANAGED_PROXY) to handle proxying and header inspection without exposing workload IP addresses.This architecture strictly isolates each tier's fault domain and network perimeter while providing line-rate performance and comprehensive Layer 7 traffic management.
This option deploys multi-NIC VMs with network interfaces attached to multiple VPCs to bridge traffic, uses an Internal Passthrough Network Load Balancer for inter-tier distribution, and routes Google API traffic through a third-party Router appliance VM.
The application required raw Layer 4 high-throughput packet inspection using third-party next-generation firewall (NGFW) appliances deployed in a centralized transit VPC.
This configuration implements Private Services Access (PSA) across VPC networks, configures static Cloud VPN tunnels to route inter-tier traffic, and assigns ephemeral external IP addresses to backend instances while using firewall rules to restrict egress.
The organization were connecting an on-premises data center to a legacy VPC using static IPsec tunnels and peering with Google managed services that only support PSA.
This option uses a full mesh of VPC Network Peering to interconnect all VPCs, relies on an External Application Load Balancer paired with Cloud Armor for ingress/routing, and deploys Cloud NAT for outbound internet communication to reach Google APIs.
The workload required public internet-facing ingress for external end-users and outbound third-party SaaS integration over public IPv4 addresses.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated