Google Professional Cloud Network Engineer Question 353
Single answerGoogle Cloud PlatformYour organization is using Google Cloud Platform to host a web application. You need to configure a firewall rule to allow HTTP traffic (port 80) to specific VM instances based on their target network tags. Additionally, you want to ensure that the firewall rule does not apply to other instances in the same VPC. How should you configure the firewall rule?
- A
Create a firewall rule with the 'allow' action, specify 'tcp:80' as the protocol and port, and assign the target network tag to the instances that need HTTP access.
- B
Create a firewall rule with the 'deny' action, specify 'tcp:80' as the protocol and port, and leave the target network tag field empty.
- C
Create a firewall rule with the 'allow' action, specify 'tcp:80' as the protocol and port, and use a secure tag to apply the rule to all instances.
- D
Create a firewall rule with the 'allow' action, specify 'tcp:80' as the protocol and port, and assign a service account to the firewall rule.
Show answer and explanation
Correct answer: A
Explanation
To allow HTTP traffic to specific VM instances while excluding others, you must use a firewall rule with the 'allow' action, specify 'tcp:80' as the protocol and port, and apply a target network tag to the intended instances. Target network tags are specifically designed for selectively applying firewall rules to VM instances within a VPC.
- A. Correct.
This is correct. By creating a firewall rule with the 'allow' action, specifying 'tcp:80', and assigning a target network tag to specific instances, you can ensure that only those instances are affected by the rule.
- B. Incorrect.
This is incorrect. Using the 'deny' action would block HTTP traffic instead of allowing it. Additionally, leaving the target network tag empty would apply the rule to all instances in the VPC.
- C. Incorrect.
This is incorrect. While secure tags can be used for access control, they are not applicable to firewall rules in this context. Target network tags are required to scope the rule to specific VM instances.
- D. Incorrect.
This is incorrect. Service accounts are not used to directly assign firewall rules to instances. Instead, firewall rules are scoped using target network tags.