Google Associate Cloud Engineer Question 159
Single answerGoogle Cloud PlatformYou are managing a Google Cloud project for an e-commerce application. The application runs on a Compute Engine instance in a default VPC network. You need to ensure that only SSH access from a specific IP address (203.0.113.5) is allowed, while all other external SSH access should be denied. How would you accurately achieve this using Google Cloud firewall rules?
- A
Create an ingress rule with priority 1000 to allow TCP traffic on port 22 from 203.0.113.5, and another ingress rule with priority 1000 to deny all TCP traffic on port 22 from 0.0.0.0/0.
- B
Create an ingress rule with priority 100 to allow TCP traffic on port 22 from 203.0.113.5, followed by an ingress rule with priority 200 to deny all TCP traffic on port 22 from 0.0.0.0/0.
- C
Create an ingress rule with priority 100 to allow TCP traffic on port 22 from 203.0.113.5, and another ingress rule with priority 200 to deny all TCP traffic on port 22 from 0.0.0.0/0.
- D
Create an ingress rule with priority 1000 to allow TCP traffic on port 22 from 203.0.113.5, and another ingress rule with priority 2000 to deny all TCP traffic on port 22 from 0.0.0.0/0.
Show answer and explanation
Correct answer: C
Explanation
In Google Cloud, firewall rules are evaluated in order of their priority, with lower numerical values taking precedence. To allow SSH access only from a specific IP address while denying all others, the allow rule must have a higher precedence (lower numerical priority) than the deny rule. Option 3 sets the correct priorities, allowing SSH traffic from 203.0.113.5 while denying it from all other sources.
- A. Incorrect.
This option does not correctly prioritize the rules. Both rules have the same priority, which means they will not work as intended. Specific allow rules should have a higher priority than deny rules.
- B. Incorrect.
This option incorrectly sets the priorities. The allow rule should have a lower numerical priority (higher precedence) than the deny rule for it to take effect correctly.
- C. Correct.
This option correctly sets the allow rule with a lower numerical priority to take precedence over the deny rule, effectively allowing SSH access only from 203.0.113.5.
- D. Incorrect.
Although this option sets the rules correctly, the priorities are unnecessarily high. Lower numerical values for priorities are recommended for better management and understanding.