Google Associate Cloud Engineer Question 157
Select 2Google Cloud PlatformYou are tasked with securing a web application hosted on Google Cloud Platform. The application is running on a Compute Engine instance in a custom VPC. You need to configure firewall rules to allow HTTP traffic from the internet to the web server and ensure that only necessary outbound traffic is permitted. Which of the following steps should you take to configure the correct ingress and egress rules?
- A
Create an ingress firewall rule allowing TCP traffic on port 80 from the source IP range 0.0.0.0/0.
- B
Create an ingress firewall rule allowing TCP traffic on port 443 from the source IP range 0.0.0.0/0.
- C
Create an egress firewall rule denying all traffic to destination IP range 0.0.0.0/0.
- D
Create an ingress firewall rule allowing ICMP traffic from the source IP range 0.0.0.0/0.
- E
Create an egress firewall rule allowing TCP traffic to destination IP range 0.0.0.0/0.
Show answer and explanation
Correct answers: A, E
Explanation
To secure a web application on GCP, you need to configure ingress rules to allow incoming HTTP traffic and egress rules to ensure necessary outbound communications. Option 1 ensures the web server can receive HTTP traffic from any source, and option 5 allows the instance to communicate with external services. These configurations are essential for maintaining both access and security for the web application.
- A. Correct.
This option correctly allows HTTP traffic on port 80 from any source, which is necessary for a publicly accessible web server.
- B. Incorrect.
Allowing TCP traffic on port 443 is necessary for HTTPS, but the question specifically focuses on HTTP. This is not the correct answer for the scenario described.
- C. Incorrect.
Denying all outbound traffic would prevent necessary egress traffic, including DNS and other service communications, which is not advisable.
- D. Incorrect.
Allowing ICMP traffic from any source is not required for the scenario described, as the focus is on HTTP traffic.
- E. Correct.
This option allows outbound TCP traffic, which is necessary for the instance to communicate with external services, such as DNS and software updates.