You are in charge of migrating a legacy application from your company datacenters to GCP before the current maintenance contract expires.
You do not know what ports the application is using and no documentation is available for you to check.
You want to complete the migration without putting your environment at risk.
What should you do?
Click on the arrows to vote for the correct answer
A. B. C. D.C.
When migrating a legacy application from an on-premises datacenter to Google Cloud Platform (GCP), it is important to ensure that the migration is performed in a secure manner, without exposing the environment to risks. One of the challenges in this process is that sometimes there is no documentation available on what ports the application is using. To address this challenge, we need to follow a methodical approach to migrate the application while minimizing security risks.
Answer A: The approach recommended in answer A involves migrating the application into an isolated project using a "Lift & Shift" approach. This means that the application is moved as is, without making any significant changes to the underlying architecture. This is often the easiest approach for legacy applications because it minimizes the need for extensive testing and development.
Once the application is migrated to GCP, we can enable all internal TCP traffic using VPC Firewall rules. This means that we will allow all traffic within the VPC, but we will not allow any traffic from outside the VPC. This approach minimizes the risk of unauthorized access to the environment, but it also means that we are allowing all traffic within the VPC, which may not be necessary.
To address this issue, we can use VPC Flow logs to determine what traffic should be allowed for the application to work properly. VPC Flow logs allow us to capture network traffic metadata and analyze it to gain insight into what traffic is being sent and received by the application. We can use this information to create more granular firewall rules that allow only the necessary traffic and block all other traffic.
Answer B: Answer B suggests that we migrate the application into an isolated project using a "Lift & Shift" approach in a custom network. This approach is similar to Answer A, but it differs in the way that we handle network traffic.
In this case, we would disable all traffic within the VPC, which means that no traffic would be allowed in or out of the project. We would then look at the Firewall logs to determine what traffic should be allowed for the application to work properly. This approach is more granular than Answer A because we are not allowing all traffic within the VPC, but it requires more manual effort to determine which traffic should be allowed and which traffic should be blocked.
Answer C: Answer C suggests that we refactor the application into a microservices architecture in a GKE cluster. This means that we would break the application down into smaller, more manageable components that can be deployed independently.
Once the application is refactored into microservices, we would disable all traffic from outside the cluster using Firewall Rules. This approach ensures that no traffic is allowed into the environment from outside the GKE cluster, which minimizes the risk of unauthorized access.
Similar to Answer A, we would then use VPC Flow logs to determine what traffic should be allowed for the application to work properly. This approach is more granular than Answer A because we are not allowing all traffic within the VPC, but it requires significant changes to the underlying architecture of the application.
Answer D: Answer D suggests that we refactor the application into a microservices architecture hosted in Cloud Functions in an isolated project. This approach is similar to Answer C, but it differs in the way that we deploy the application.
In this case, we would use Cloud Functions to host the individual components of the application, rather than deploying them in a GKE cluster. We would also disable all traffic from outside our project using Firewall Rules, which means that no traffic would be allowed in or out of the project.
Similar to Answer A and Answer C, we would use VPC Flow logs to determine what traffic should be allowed for the application to work properly. This approach is the most granular of all the answers, but it requires significant changes to