Google Professional Cloud Network Engineer Question 341
Single answerGoogle Cloud PlatformYou are a network engineer for a company hosting multiple applications in Google Cloud. Your team wants to ensure that only specific IP ranges can access certain backend services in a VPC. You decide to use Google Cloud's 'include' feature in a firewall rule to achieve this. Which of the following configurations would be correct to allow traffic only from the specified IP range 192.168.1.0/24 to a backend service tagged with 'backend-service'?
- A
Create an ingress firewall rule with 'include' set to '192.168.1.0/24' and target tag 'backend-service'.
- B
Create an ingress firewall rule with 'include' set to 'backend-service' and source IP range '192.168.1.0/24'.
- C
Create an ingress firewall rule with source IP range '192.168.1.0/24' and target tag 'backend-service'.
- D
Create an egress firewall rule with 'include' set to '192.168.1.0/24' and target tag 'backend-service'.
Show answer and explanation
Correct answer: C
Explanation
To allow traffic only from a specific IP range to a particular service in a VPC, you must create an ingress firewall rule. The 'source IP ranges' field should define the allowed IP ranges (e.g., 192.168.1.0/24), and the 'target tags' field should be used to specify the instances or services (e.g., 'backend-service') that the rule applies to. The 'include' field is not relevant in this context and is not a valid field for firewall rules.
- A. Incorrect.
Incorrect: The 'include' field is not valid for specifying IP ranges. Instead, IP ranges should be set in the 'source IP ranges' field.
- B. Incorrect.
Incorrect: The 'include' field is incorrectly used here to specify target tags. The correct approach is to use 'target tags' to define which instances the rule applies to.
- C. Correct.
Correct: This configuration correctly uses the 'source IP range' field to specify the allowed IP range and the 'target tag' to define the backend service to which the rule applies.
- D. Incorrect.
Incorrect: Egress rules are not used for restricting incoming traffic. This configuration would not achieve the desired restriction for ingress traffic.