Database servers run in subnet-a; application and web servers run in subnet-b of the default VPC. Allow database traffic only from application servers to database servers. What should you do?
Choose an answer
Tap an option to check your answer.
Correct answer: Create service accounts sa-app and sa-db; assign sa-app to application servers and sa-db to database servers; create an ingress firewall rule allowing traffic from source service account sa-app to target service account sa-db..
Why this is the answer
The correct solution uses service accounts as both source and target for an ingress firewall rule. This allows precise control, ensuring only application servers (with sa-app) can initiate connections to database servers (targeting instances with sa-db). The option using network tags for an egress rule is incorrect because egress rules define traffic leaving the source, not traffic entering the target. While network tags can be used for sources/targets, the egress direction is wrong for this scenario. The other incorrect options mix service accounts and network tags in ways that don't achieve the desired precise control or use incorrect firewall rule directions/sources/targets. For example, using "source VPC IPs to subnet-a IPs" is too broad and doesn't restrict traffic to just application servers.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed