Google Associate Cloud Engineer Question 158
Select 2Google Cloud PlatformYou are tasked with securing the traffic to and from a VM instance in your Google Cloud Platform project. The VM is part of a web application, which needs to allow incoming HTTP traffic from anywhere, but restrict all other incoming traffic. It should also allow all outgoing traffic. How should you configure the firewall rules to meet these requirements?
- A
Create an ingress rule allowing TCP traffic on port 80 from 0.0.0.0/0.
- B
Create an ingress rule allowing TCP traffic on port 80 from your internal network IP range only.
- C
Create an ingress rule denying all traffic on all ports from 0.0.0.0/0.
- D
Create an egress rule allowing all traffic.
- E
Create an egress rule denying all traffic except for the specific IP ranges you need to reach.
Show answer and explanation
Correct answers: A, D
Explanation
To meet the requirements, you need to allow ingress traffic for HTTP from any source, which is accomplished by the first rule. For outgoing traffic, the requirement is to allow all, which is achieved by the fourth rule. These configurations ensure that the VM can serve HTTP requests to the public while not restricting its ability to initiate outbound connections.
- A. Correct.
This option correctly allows HTTP traffic (port 80) from anywhere, which is necessary for a public web server.
- B. Incorrect.
This would restrict HTTP traffic to only your internal network, which does not meet the requirement for a public web application.
- C. Incorrect.
While this option would deny unwanted traffic, it would also block the required HTTP traffic, conflicting with the requirement.
- D. Correct.
This option correctly allows all outgoing traffic, which meets the requirement.
- E. Incorrect.
This would overly restrict outgoing traffic and is not necessary given the requirement to allow all outgoing traffic.