Google Professional Cloud Network Engineer Question 339
Select 3Google Cloud PlatformYou are tasked with configuring Cloud Next Generation Firewall (NGFW) rules for a project in Google Cloud. The objective is to allow only HTTPS traffic to a specific backend service while ensuring the rules are efficient and secure. Which of the following considerations should you implement when configuring the NGFW rules?
- A
Define the rule with the least specific priority number to ensure it is evaluated first.
- B
Use target service accounts to restrict the rule's scope to the backend service.
- C
Specify 'tcp:443' in the rule to allow only HTTPS traffic.
- D
Enable logging for the rule to monitor traffic and troubleshoot issues.
- E
Add a second rule to allow ingress traffic on all ports for testing purposes.
Show answer and explanation
Correct answers: B, C, D
Explanation
When configuring Cloud NGFW rules, it is crucial to follow best practices for security and efficiency. Using target service accounts ensures that rules apply only to the intended backend service, while specifying 'tcp:443' restricts traffic to HTTPS, meeting the requirement. Enabling logging assists in monitoring and troubleshooting. However, rules with non-specific priorities or allowing all-port access introduce risks and do not align with the goal of efficient, secure rule management.
- A. Incorrect.
This is incorrect because rules with lower priority numbers have higher precedence. Using a non-specific priority number could lead to unintended traffic being allowed or denied.
- B. Correct.
This is correct. Using target service accounts is a best practice as it limits the scope of the rule to only the intended resources, enhancing security.
- C. Correct.
This is correct. By specifying 'tcp:443', the rule explicitly allows only HTTPS traffic, meeting the requirement.
- D. Correct.
This is correct. Enabling logging helps monitor traffic and identify potential misconfigurations or unauthorized access attempts.
- E. Incorrect.
This is incorrect. Allowing traffic on all ports for testing purposes is not recommended as it introduces unnecessary security risks.