Google Professional Cloud Network Engineer Question 348
Select 2Google Cloud PlatformYour company has a Compute Engine instance running in the us-central1 region. This instance hosts a web application that needs to be accessible from the internet on port 443. To enhance security, you want to restrict access to specific IP ranges while ensuring no other traffic is allowed. Which steps should you perform to accomplish this?
- A
Create an ingress firewall rule allowing TCP traffic on port 443 for the specific IP ranges and apply it to the instance's network tag.
- B
Create a global network policy restricting all ingress traffic except from the specific IP ranges.
- C
Create a default-allow-ssh firewall rule with priority 1000 to ensure SSH access is available for troubleshooting.
- D
Create an egress firewall rule denying all traffic from the instance to external IP addresses.
- E
Remove the default-allow-ingress firewall rule from the VPC.
- F
Set up a logging policy to monitor denied traffic on port 443.
Show answer and explanation
Correct answers: A, B
Explanation
To secure access to the Compute Engine instance, an ingress firewall rule targeting the specific IP ranges and port 443 is essential. Additionally, a global network policy can ensure that any traffic not explicitly allowed is denied at the VPC level. These steps collectively restrict access while meeting the security requirements.
- A. Correct.
This is correct. An ingress firewall rule with the allowed port and specific IP ranges ensures only the desired traffic can reach the Compute Engine instance.
- B. Correct.
This is correct. A global network policy can be used to restrict ingress traffic at the VPC level, providing an additional layer of control.
- C. Incorrect.
This is incorrect. Allowing SSH access is not relevant to the requirement of securing port 443 access for the web application.
- D. Incorrect.
This is incorrect. There is no requirement in the scenario to restrict egress traffic from the instance.
- E. Incorrect.
This is incorrect. The default-allow-ingress firewall rule does not exist by default. There are specific default rules (e.g., default-allow-internal or default-allow-ssh), but removing them is unrelated to the scenario.
- F. Incorrect.
This is incorrect. While logging can help monitor traffic, the scenario specifically focuses on configuring access restrictions, not monitoring traffic.