Download Latest Professional-Cloud-Security-Engineer Questions

To restrict access to the MySQL instance to only the frontend application while other VMs are present in the subnets, creating an ingress firewall rule is the most appropriate approach. This rule will specifically allow traffic from subnet A (where the frontend application resides) to the MySQL instance in subnet B on port 3306, using network tags to target the specific MySQL VM.

Steps:

Create Network Tags: Apply a network tag (e.g., "data-tag") to the MySQL VM in subnet B.

Create Ingress Firewall Rule: Configure an ingress firewall rule with the following settings:

Source IP Range: Subnet A's IP range.

Target Tag: "data-tag".

Allowed Protocol/Ports: TCP:3306 (for MySQL).

This setup ensures that only instances in subnet A can communicate with the MySQL instance on port 3306.

Compute Engine doesn't automatically update the OS or the software on your deployed instances. You will need to patch or update your deployed Compute Engine instances when necessary. However, in the cloud it is not recommended that you patch or update individual running instances. Instead it is best to patch the image that was used to launch the instance and then replace each affected instance with a new copy.

Shared responsibility “Security of the Cloud” - GCP is responsible for protecting the infrastructure that runs all of the services offered in the GCP Cloud. This infrastructure is composed of the hardware, software, networking, and facilities that run GCP Cloud services.

Comprehensive and Detailed Explanation From Exact Extract:

The requirements necessitate a private, cross-project service-to-service connection with explicit authorization—a capability perfectly addressed by Private Service Connect (PSC).

Internal Load Balancer: Ensures the service is isolated from the internet (Layer 7 Load Balancer for HTTP/S ML endpoint).

Private Service Connect (PSC): Allows a service (the model endpoint, exposed via the internal load balancer) in one VPC/project (producer) to be securely consumed by other VPCs/projects (consumers) using an internal IP address.

Defined List of Projects: PSC enables Explicit authorization, allowing the producer to define the allowed list of consumers that can establish a connection, directly meeting the granular restriction requirement.

Extracts:

"Private Service Connect provides... Explicit authorization. Private Service Connect provides an authorization model that gives consumers and producers granular control." (Source 2.4)

"Private Service Connect backends let Google Cloud load balancers send traffic through Private Service Connect to reach published services... Placing a load balancer in front of a managed service provides the consumer with more visibility and control..." (Source 2.4)

"Publish services by using Private Service Connect... Select the internal load balancer that hosts the service that you want to publish." (Source 2.3)