Google Professional Cloud Network Engineer Question 345
Select 3Google Cloud PlatformYou are designing a network for a company that requires all virtual machines in a specific subnet to only accept SSH traffic from a trusted external IP range while denying all other external traffic. However, traffic within the same subnet should remain unrestricted. Which firewall rule configuration should you implement?
- A
Create an ingress firewall rule with a priority of 1000 to allow SSH (TCP:22) traffic from the trusted IP range to the subnet.
- B
Create an ingress firewall rule with a priority of 1000 to allow all traffic within the same subnet.
- C
Create a global egress firewall rule with a priority of 1000 to deny all traffic from external IP ranges.
- D
Create an ingress firewall rule with a lower priority to deny all incoming external traffic to the subnet.
- E
Create an ingress firewall rule with a higher priority to allow all traffic from the trusted IP range to any port.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the requirements, you need to allow SSH traffic from the trusted IP range while denying all other external traffic. The ingress rule with a high priority (1000) ensures SSH traffic is permitted, while the lower-priority deny rule blocks other external traffic. Additionally, traffic within the same subnet should remain unrestricted, which is handled by a specific rule for intra-subnet traffic.
- A. Correct.
Correct: This rule explicitly allows SSH traffic from the trusted IP range to the specified subnet. Priority 1000 ensures it is evaluated before less specific rules.
- B. Correct.
Correct: This rule ensures that traffic within the same subnet is unrestricted and does not interfere with other rules.
- C. Incorrect.
Incorrect: A global egress rule is not required in this scenario since the requirement is about restricting ingress traffic, not egress.
- D. Correct.
Correct: This lower-priority rule ensures that all other external traffic, except the trusted range, is denied.
- E. Incorrect.
Incorrect: Allowing all traffic from the trusted IP range to any port violates the requirement to restrict traffic only to SSH (TCP:22).