Google Professional Cloud Network Engineer Question 360
Single answerGoogle Cloud PlatformYou are tasked with configuring a firewall rule in your Google Cloud Virtual Private Cloud (VPC) network to allow SSH traffic (TCP port 22) from a specific subnet (10.1.2.0/24) to a group of virtual machines tagged as 'web-servers'. The rule should only allow ingress traffic and ensure it takes precedence over existing rules. Which of the following configurations will correctly achieve this?
- A
Configure an ingress firewall rule with a priority of 1000, source IP range as 10.1.2.0/24, target tags as 'web-servers', protocol as TCP, port as 22.
- B
Configure an egress firewall rule with a priority of 1000, source IP range as 10.1.2.0/24, target tags as 'web-servers', protocol as TCP, port as 22.
- C
Configure an ingress firewall rule with a priority of 500, source IP range as 10.1.2.0/24, target tags as 'web-servers', protocol as TCP, port as 22.
- D
Configure an ingress firewall rule with a priority of 1000, source IP range as 0.0.0.0/0, target tags as 'web-servers', protocol as TCP, port as 22.
Show answer and explanation
Correct answer: A
Explanation
The correct configuration requires an ingress firewall rule because the requirement is to allow incoming traffic. A priority of 1000 ensures the rule takes precedence over other rules with lower priorities. The source IP range must be restricted to the specified subnet (10.1.2.0/24), and the rule must target VMs tagged as 'web-servers'. Additionally, the protocol and port must match the requirement for SSH traffic (TCP port 22).
- A. Correct.
This option is correct because it specifies an ingress rule, sets the proper source IP range (10.1.2.0/24), targets the correct VMs using the 'web-servers' tag, specifies TCP protocol with port 22, and has a priority of 1000. This configuration ensures the rule applies to SSH traffic from the desired subnet.
- B. Incorrect.
This option is incorrect because it specifies an egress firewall rule, which is used for traffic leaving the VPC, whereas the requirement is to allow ingress (incoming) traffic.
- C. Incorrect.
This option is incorrect because although it specifies an ingress rule with the correct source IP range, target tags, protocol, and port, the priority of 500 is a lower value and would override other rules with a higher priority number. The requirement is to ensure this rule takes precedence, so the priority should remain at 1000.
- D. Incorrect.
This option is incorrect because it specifies a source IP range of 0.0.0.0/0, which would allow SSH traffic from any IP address rather than restricting it to the specific subnet (10.1.2.0/24) mentioned in the requirement.