Google Professional Cloud Network Engineer Question 337
Select 4Google Cloud PlatformYou are tasked with configuring Cloud Next Generation Firewall (NGFW) rules for your organization’s Google Cloud environment. Your goal is to allow outbound traffic from a specific subnet to a public API endpoint and block all other outbound traffic from the subnet. Which of the following considerations should you account for when configuring the firewall rules?
- A
Ensure that the rule priority for the outbound allow rule is set lower than the block rule.
- B
Specify the subnet as the source in both the allow and block rules.
- C
Use service accounts to scope the rules to specific workloads only when necessary.
- D
Enable logging for the rules to analyze traffic behavior and troubleshoot issues.
- E
Configure the destination filter in the allow rule to specify the public API endpoint's IP range.
Show answer and explanation
Correct answers: B, C, D, E
Explanation
When managing Cloud NGFW rules, it is important to configure them with proper consideration for priority, scope, and logging. In this scenario, the subnet must be specified to ensure the rules target the correct traffic. Additionally, using service accounts and enabling logging enhances security and visibility. The destination filter ensures precision by limiting outbound traffic to the specific API endpoint, achieving the desired functionality while maintaining a secure environment.
- A. Incorrect.
Incorrect: Lower priority numbers represent higher precedence in Google Cloud firewall rules. Therefore, the allow rule must have a higher priority (lower number) than the block rule to ensure outbound traffic to the API is permitted.
- B. Correct.
Correct: Specifying the subnet as the source ensures that the rules apply only to traffic originating from the desired subnet.
- C. Correct.
Correct: Using service accounts to scope firewall rules allows you to refine access control and apply rules to specific workloads, improving security.
- D. Correct.
Correct: Enabling logging is an essential consideration to monitor and troubleshoot firewall rules effectively.
- E. Correct.
Correct: Configuring the destination filter ensures that only traffic destined for the specific API endpoint is allowed, preventing unintended access to other destinations.