Which TWO are best practices when designing a VPC network for a multi-tier application in Google Cloud?