Google Associate Cloud Engineer Question 173
Select 3Google Cloud PlatformYou are tasked with setting up a secure method for your team to remotely connect to a Google Compute Engine instance. The instance is running a web application that requires SSH access for maintenance. Which of the following steps should you take to ensure secure and efficient remote access?
- A
Enable the 'Allow HTTP traffic' option in the VM instance settings.
- B
Create a Cloud Identity-Aware Proxy (IAP) tunnel to access the instance via SSH.
- C
Add SSH keys to the instance metadata for each team member.
- D
Configure a firewall rule to allow SSH traffic from the team's IP address range.
- E
Use Google Cloud Console's built-in SSH feature.
Show answer and explanation
Correct answers: B, D, E
Explanation
To securely access a Google Compute Engine instance, using IAP for tunneling SSH traffic is a preferred method as it does not require opening additional ports. Limiting SSH access using firewall rules to specific IP ranges enhances security. Additionally, the Google Cloud Console's built-in SSH access provides a secure and easy-to-use option without requiring manual SSH key management.
- A. Incorrect.
This option enables HTTP traffic to the instance, which is related to web access, not SSH.
- B. Correct.
Using IAP to create a tunnel for SSH access is secure and does not require exposing the instance's external IP.
- C. Incorrect.
Adding SSH keys to instance metadata is a valid method but can lead to management overhead and security concerns.
- D. Correct.
Configuring a firewall rule allows SSH access limited to your team's IP range, enhancing security by restricting access.
- E. Correct.
Google Cloud Console's built-in SSH feature is a secure and convenient way to access the instance without managing keys.