Google Professional Cloud Network Engineer Question 361
Single answerGoogle Cloud PlatformYou are managing a VPC network in Google Cloud and need to create a firewall rule that allows SSH traffic to virtual machines in a specific subnet. The rule should only apply to connections coming from a specific IP range (203.0.113.0/24) and must have a higher priority than the default-allow-ssh rule. Which configuration should you use?
- A
Set the direction to ingress, priority to 1000, allow TCP:22, source IP range to 203.0.113.0/24, and apply the rule to all instances in the network.
- B
Set the direction to ingress, priority to 900, allow TCP:22, source IP range to 203.0.113.0/24, and target the specific subnet.
- C
Set the direction to egress, priority to 900, allow TCP:22, source IP range to 203.0.113.0/24, and target the specific subnet.
- D
Set the direction to ingress, priority to 100, allow all protocols, source IP range to 203.0.113.0/24, and target the specific subnet.
Show answer and explanation
Correct answer: B
Explanation
To allow SSH traffic from a specific IP range to a specific subnet, you must configure an ingress rule that permits TCP:22 traffic. The priority must be lower than the default-allow-ssh rule's priority (1000) to ensure it takes precedence. Additionally, targeting the specific subnet ensures the rule is applied only where needed, improving security and compliance with the principle of least privilege.
- A. Incorrect.
This option sets the priority to 1000, which is lower than the default-allow-ssh rule (priority 1000 by default), so it would not override it. Additionally, it applies the rule to all instances in the network rather than targeting the specific subnet.
- B. Correct.
This option correctly sets the direction to ingress, assigns a higher priority (900) to override the default-allow-ssh rule, allows TCP:22 traffic, specifies the correct source IP range, and limits the rule to the specific subnet.
- C. Incorrect.
This option incorrectly sets the direction to egress, which is not applicable for allowing incoming SSH traffic. Egress rules control outbound traffic, not inbound.
- D. Incorrect.
This option sets the priority to 100, which is higher than necessary for this scenario and allows all protocols instead of restricting to TCP:22. This makes the rule too permissive and does not align with the requirements.