Google Associate Cloud Engineer Question 155
Select 1Google Cloud PlatformYour organization has deployed a web application on Google Cloud Platform using Compute Engine instances in a custom VPC network. You have been tasked with ensuring that only HTTP and HTTPS traffic from the internet is allowed to reach these instances. Which of the following steps should you take to configure the appropriate firewall rules?
- A
Create an ingress firewall rule allowing TCP traffic on ports 80 and 443 from 0.0.0.0/0.
- B
Create an egress firewall rule allowing TCP traffic on ports 80 and 443 to 0.0.0.0/0.
- C
Create an ingress firewall rule denying all traffic except TCP traffic on ports 80 and 443 from 0.0.0.0/0.
- D
Create an ingress firewall rule allowing HTTP traffic from a specific on-premises IP range.
- E
Remove any default firewall rules that allow incoming traffic from the internet.
Show answer and explanation
Correct answer: A
Explanation
To control which traffic can reach your Compute Engine instances, you should create ingress firewall rules. An ingress rule that allows TCP traffic on ports 80 and 443 from 0.0.0.0/0 will ensure that the instances can receive HTTP and HTTPS traffic from any external source, fulfilling the requirement to restrict access to only web traffic.
- A. Correct.
This option correctly describes creating an ingress rule to allow web traffic (HTTP and HTTPS) from any external source to reach the VPC network.
- B. Incorrect.
This option describes an egress rule, which is not necessary for controlling incoming traffic to the instances.
- C. Incorrect.
While this option partially conveys the need to allow traffic on ports 80 and 443, creating a deny rule is not the recommended approach when specific allow rules can be defined.
- D. Incorrect.
This option focuses on traffic from a specific on-premises range and does not address the requirement to allow traffic from the internet.
- E. Incorrect.
Default firewall rules typically include rules for internal traffic, not for allowing traffic from the internet, so this option is not relevant.