Your web application has several VM instances running within a VPC. You want to restrict communications between instances to only the paths and ports you authorize, but you don't want to rely on static IP addresses or subnets because the app can autoscale. How should you restrict communications?

Firewall rules based on network tags are the most effective solution for restricting communication between instances in an autoscaling environment. Network tags are metadata attached to VM instances, allowing you to dynamically apply firewall rules to groups of instances without relying on static IP addresses or subnets, which change with autoscaling. This ensures that as instances are added or removed, the security policies are automatically enforced. Using separate VPCs would introduce unnecessary complexity and overhead for inter-instance communication within a single application. Cloud DNS resolves hostnames to IP addresses but doesn't inherently restrict network traffic. While service accounts are crucial for authentication and authorization to Google Cloud resources, they do not control network-level communication between VM instances.