Google Professional Cloud Network Engineer Question 347
Select 2Google Cloud PlatformYou are setting up a multi-region application on Google Cloud that requires secure communication between VM instances in different regions. The application also needs to block all incoming traffic except for SSH (TCP/22) and HTTPS (TCP/443). Which steps should you take to meet these requirements?
- A
Create a global firewall rule allowing ingress traffic on TCP/22 and TCP/443.
- B
Create a regional firewall rule allowing ingress traffic on TCP/22 and TCP/443 for each region.
- C
Create a global firewall rule to block all other ingress traffic by setting the priority lower than the allow rule.
- D
Set up a hierarchical firewall policy at the organization level to allow ingress traffic on TCP/22 and TCP/443.
- E
Set up a hierarchical firewall policy at the organization level to block all other ingress traffic.
Show answer and explanation
Correct answers: A, C
Explanation
To securely configure communication for a multi-region application, using global firewall rules is the optimal choice. A global rule allows consistent access control across regions without requiring separate regional configurations. By allowing specific ports (TCP/22 and TCP/443) and blocking all other ingress traffic, you ensure security while meeting the application's requirements. Hierarchical firewall policies are unnecessary for this specific use case and may introduce broader impacts beyond the scope of the application.
- A. Correct.
This is correct because a global firewall rule can manage traffic across multiple regions. A global rule simplifies configuration and ensures uniform access control for the required ports (TCP/22 and TCP/443).
- B. Incorrect.
This is incorrect because regional firewall rules would require separate configurations for each region, leading to increased management overhead. A global rule is more efficient in this scenario.
- C. Correct.
This is correct because blocking all other ingress traffic ensures that only the specified ports (TCP/22 and TCP/443) are allowed. Setting the priority lower than the allow rule ensures the deny rule does not interfere with the allow rule.
- D. Incorrect.
This is incorrect because hierarchical firewall policies at the organization level are not necessary for this scenario. Global firewall rules can achieve the same purpose without involving the organization hierarchy.
- E. Incorrect.
This is incorrect because blocking ingress traffic at the organization level would affect all projects under the organization, which may not be the desired behavior for this specific application.