Google Professional Cloud Network Engineer Question 370
Select 2Google Cloud PlatformYour organization uses Google Cloud and has multiple projects under a single folder in Google Cloud Resource Manager. You need to ensure that all projects under this folder comply with the following security requirements:
- Block all SSH traffic from external IPs to internal resources.
- Allow HTTP and HTTPS traffic from any external source.
You decide to implement these requirements using hierarchical firewall policies. What steps should you take to configure this correctly?
- A
Create a hierarchical firewall rule at the organization level to block ingress SSH traffic from all external IPs and set its priority to a higher value (e.g., 100).
- B
Create a hierarchical firewall rule at the folder level to block ingress SSH traffic from all external IPs and set its priority to a lower value (e.g., 900).
- C
Create a hierarchical firewall rule at the folder level to allow ingress HTTP and HTTPS traffic from all external sources, setting its priority to a lower value (e.g., 900).
- D
Create a hierarchical firewall rule at the folder level to allow ingress HTTP and HTTPS traffic from all external sources, setting its priority to a higher value (e.g., 100).
- E
Create individual VPC firewall rules in each project to block ingress SSH traffic and allow ingress HTTP/HTTPS traffic.
Show answer and explanation
Correct answers: B, C
Explanation
Hierarchical firewall policies allow you to define and enforce security rules centrally at the organization or folder level, reducing the need for individual project-specific configurations. By creating a rule at the folder level to block SSH traffic and another to allow HTTP/HTTPS traffic, you can ensure that the security requirements are applied consistently across all projects within the folder. The use of appropriate priorities ensures that rules are evaluated in the correct order.
- A. Incorrect.
Incorrect. While creating a rule at the organization level is possible, it is not the best practice to enforce project-specific security requirements at the organization level. Additionally, the priority should be lower (not higher) for rules that need to be evaluated later.
- B. Correct.
Correct. Creating a hierarchical firewall rule at the folder level allows you to enforce the SSH blocking policy for all projects within the folder. Setting a lower priority value (e.g., 900) ensures that it is evaluated after higher priority rules (e.g., HTTP/HTTPS allow).
- C. Correct.
Correct. This rule allows HTTP and HTTPS traffic from external sources and applies it to all projects under the folder. Setting a lower priority (e.g., 900) ensures it is evaluated appropriately, without conflicting with other higher-priority rules.
- D. Incorrect.
Incorrect. Although this rule allows HTTP and HTTPS traffic, setting a higher priority (e.g., 100) would cause it to incorrectly override other rules, such as the SSH block rule.
- E. Incorrect.
Incorrect. Using individual VPC firewall rules in each project is not efficient for centralized security management. Hierarchical firewall policies are recommended for managing rules across multiple projects under a folder or organization.