Cloud Digital Leader Fundamental Cloud Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Configure firewall rules to allow only necessary traffic

  Why this is correct

  VPC firewall rules act as the first line of defense by controlling ingress/egress traffic at the network layer. In GCP, every VM or GKE node's interface can be governed by hierarchical or tag-based rules, enabling segmentation between microservice tiers. Restricting traffic to only the required ports and source/destination CIDRs or service tags dramatically reduces the attack surface and limits lateral movement during a breach.

• ✓

  Enable VPC Flow Logs to capture network metadata

  Why this is correct

  VPC Flow Logs record network metadata such as source/destination IP, port, and protocol for each sampled connection. Exporting these logs to Cloud Logging or BigQuery lets you audit actual traffic flows, detect anomalous patterns like port scanning or data exfiltration, and confirm that firewall rules are working as intended. They are not a substitute for encryption or access control, but they provide indispensable forensic evidence for incident response.

• ✗

  Assign public IP addresses to all services

  Why it's wrong here

  Assigning public IP addresses to every microservice publicly exposes them to the internet, making them reachable by any attacker and greatly expanding the attack surface. Internal services should communicate over private RFC 1918 addresses within the VPC, which are not globally routable. If external access is required, it should be mediated through Cloud Load Balancing, Cloud NAT, or a managed API gateway to protect the underlying instances. Public IPs also hinder the ability to apply fine-grained network policies.

• ✓

  Use a service mesh with mutual TLS (mTLS) between services

  Why this is correct

  A service mesh such as Anthos Service Mesh handles service-to-service authentication and encryption through mutual TLS, ensuring that each request is both encrypted and its workload identity verified. With mTLS, both client and server present certificates signed by a common CA, preventing man-in-the-middle attacks and enabling zero-trust network principles. The mesh also simplifies policy enforcement by allowing you to define authorization based on workload identity rather than brittle IP addresses or firewall rules.

• ✗

  Use the same service account for all services

  Why it's wrong here

  Reusing one service account for all microservices grants every service the union of all permissions, violating least privilege and creating a single point of compromise. If any service is breached, an attacker inherits access to resources like Cloud Storage, Pub/Sub, or databases used by other services. Instead, assign a dedicated service account to each application, scoped with minimal IAM roles and, for GKE workloads, enable Workload Identity Federation to bind Kubernetes service accounts to Google service accounts. This isolation limits the blast radius of any individual compromise.

Go deeper

Related to this question