Exam Professional Cloud Security Engineer topic 1 question 87 discussion

B for sure, u can check this : https://cloud.google.com/sql/docs/mysql/sql-proxy#using-a-service-account

Agree with B

This approach ensures that only the application frontend can access the data in the MySQL instance, while all other Compute Engine VMs in subnet A and subnet B are restricted from accessing it . By configuring an ingress firewall rule that allows communication between the frontend’s unique service account and the unique service account of the MySQL Compute Engine VM, you can ensure that only authorized users can access your MySQL instance .

B Firellas rules using service account is better than tag

"B" I believe the answer is between B and A since part of the requirement is specifying the port. B is more correct since it leverages service accounts which is best practice for authentication/communication between application and database. Also, answer "A" allows ALL instances in the subnet to reach to reach mysql which is not desired. They only want the specific Frontend instances to reach excluding other instances in the subnet. https://cloud.google.com/firewall/docs/firewalls#best_practices_for_firewall_rules

B. Configure an ingress firewall rule that allows communication from the frontend’s unique service account to the unique service account of the mysql ComputeEngine VM on port 3306.

B is correct.firellas rules using service account is better than tag based. https://cloud.google.com/vpc/docs/firewalls#best_practices_for_firewall_rules

Ans : B

why is it not a? a seems straight forward The link which Zuy01 provided for answer b states: For this reason, using a service account is the recommended method for production instances NOT running on a Compute Engine instance.

Ans : B

ans is B

Ans - B

B is correct