You have a 3-tier Compute Engine deployment. Each tier's instances use a dedicated service account. Enable TCP 8080 communication: tier1 -> tier2 and tier2 -> tier3. What should you do?

The correct option uses ingress firewall rules to allow specific TCP 8080 communication between tiers. Ingress rules control incoming traffic. By targeting instances with the service account of the receiving tier (e.g., tier 2) and sourcing from instances with the service account of the sending tier (e.g., tier 1), you precisely define the allowed communication flow. Specifying TCP:8080 ensures only the required port is open, adhering to the principle of least privilege. The incorrect options either use allow all protocols, which is too permissive, or use IP ranges, which are less flexible and harder to manage than service accounts for dynamic environments. Egress rules control outgoing traffic, which is not the primary requirement here for allowing incoming connections to a tier.