Google Professional Cloud Network Engineer Question 363
Select 2Google Cloud PlatformYour company has deployed a new web application on Google Cloud that uses a managed instance group behind an HTTP(S) Load Balancer in the default VPC. The application must only allow incoming traffic on TCP port 443 from a specific IP range (203.0.113.0/24) while blocking all other external traffic. You also need to allow the instance group to communicate with Google APIs and services for updates and monitoring. How should you configure the firewall rules for this scenario?
- A
Create an ingress firewall rule with a priority of 1000, allowing TCP port 443 traffic from the source IP range 203.0.113.0/24 and applying it to the instance group.
- B
Create an ingress firewall rule with a priority of 1000, allowing all traffic from the 0.0.0.0/0 source range to ensure proper external access.
- C
Create an egress firewall rule with a priority of 1000, allowing traffic to destination 0.0.0.0/0 on all ports for the instance group.
- D
Create an egress firewall rule with a priority of 1000, allowing traffic to destination 0.0.0.0/0 only on TCP ports 80 and 443 for the instance group.
- E
Create an egress firewall rule with a priority of 1000, allowing traffic to destination 0.0.0.0/0 only on TCP port 443 and to Google APIs and services using the 'google-cloud-services' tag.
Show answer and explanation
Correct answers: A, E
Explanation
To meet the requirements, you need two firewall rules. First, an ingress rule with a priority of 1000 to allow TCP port 443 traffic from the specified IP range (203.0.113.0/24) while blocking all other incoming traffic. Second, an egress rule with a priority of 1000 to allow traffic to Google APIs and services using the 'google-cloud-services' tag and restrict other egress traffic to only TCP port 443. These rules ensure that the application is secure and adheres to the principle of least privilege.
- A. Correct.
Correct: This rule allows only TCP port 443 traffic from a specific external IP range (203.0.113.0/24), which meets the requirement to restrict incoming traffic to the application.
- B. Incorrect.
Incorrect: Allowing all traffic from 0.0.0.0/0 would violate the requirement to restrict access to only TCP port 443 from the specific IP range.
- C. Incorrect.
Incorrect: Allowing all egress traffic to 0.0.0.0/0 on all ports is overly permissive and does not align with the principle of least privilege.
- D. Incorrect.
Incorrect: Allowing only TCP ports 80 and 443 for egress traffic does not cover communication with Google APIs and services, which is a requirement in this scenario.
- E. Correct.
Correct: This rule ensures the instance group can communicate with Google APIs and services (e.g., monitoring, updates) while restricting egress traffic to only TCP port 443 for other destinations.