Google Professional Cloud Network Engineer Question 362
Single answerGoogle Cloud PlatformYou are managing a VPC network in Google Cloud and need to configure a firewall rule to allow incoming HTTP(S) traffic from any external source to a group of web servers. The servers are tagged with the network tag 'web-servers', and the rule should have the highest priority to ensure it is evaluated first. Which configuration should you use?
- A
Create an ingress rule with priority 1000, target 'web-servers', source IP range '0.0.0.0/0', and protocols/ports set to TCP:80,443.
- B
Create an ingress rule with priority 0, target 'web-servers', source IP range '0.0.0.0/0', and protocols/ports set to TCP:80,443.
- C
Create an egress rule with priority 0, target 'web-servers', destination IP range '0.0.0.0/0', and protocols/ports set to TCP:80,443.
- D
Create an ingress rule with priority 65535, target 'web-servers', source IP range '0.0.0.0/0', and protocols/ports set to TCP:80,443.
Show answer and explanation
Correct answer: B
Explanation
To allow incoming HTTP(S) traffic from any external source to a specific group of web servers, you must create an ingress rule with the correct target (network tag 'web-servers'), source IP range ('0.0.0.0/0'), and protocols/ports (TCP:80,443). The priority must be set to the highest value (lowest number, such as 0) to ensure the rule is evaluated first. Egress rules are not applicable for controlling incoming traffic, and a low-priority value like 65535 would result in the rule being evaluated last, which does not meet the requirements.
- A. Incorrect.
This option is incorrect because although it is an ingress rule with the correct target and source IP range, the priority of 1000 is too low to ensure it is evaluated first. Lower priority values have higher precedence.
- B. Correct.
This is the correct option because it uses an ingress rule with the correct target ('web-servers'), source IP range ('0.0.0.0/0'), and protocols/ports (TCP:80,443) while assigning the highest priority (0) to ensure it is evaluated first.
- C. Incorrect.
This option is incorrect because it specifies an egress rule instead of an ingress rule. Egress rules control outbound traffic, which is not applicable in this scenario.
- D. Incorrect.
This option is incorrect because the priority of 65535 is the lowest possible, meaning it would be evaluated last. This does not meet the requirement for the rule to have the highest priority.