VPC my-project has subnet-a 10.128.0.0/20 (databases) and subnet-b 172.16.0.0/24 (apps and web). Allow only database traffic (TCP/3306) from application servers to database servers. Which firewall configuration accomplishes this?

The correct option uses service accounts for both source and target, which is the most granular and secure way to control traffic between specific instances or groups of instances in GCP. The firewall rule allows TCP port 3306 (MySQL) from instances associated with sa-app to instances associated with sa-db. The first incorrect option incorrectly mixes source-tags with target-service-accounts. Firewall rules require consistency in how sources and targets are defined. The third incorrect option unnecessarily includes source-ranges in addition to source-service-accounts, which is redundant and less precise than using only service accounts. The fourth incorrect option uses network tags for both source and target, which is less secure than service accounts because tags can be easily modified by anyone with instance edit permissions.