Google Professional Cloud Network Engineer Question 371
Single answerGoogle Cloud PlatformYour organization has a multi-folder GCP structure with Folder-A and Folder-B, both under the Organization node. You need to configure a hierarchical firewall policy that blocks all inbound SSH traffic while allowing inbound HTTPS traffic for all resources in Folder-A, but without impacting resources in Folder-B. What is the most appropriate setup?
- A
Apply a hierarchical firewall policy at the
Organizationlevel to block SSH and allow HTTPS. - B
Apply a hierarchical firewall policy at
Folder-Ato block SSH and allow HTTPS. - C
Apply a hierarchical firewall policy at
Folder-Bto block SSH and allow HTTPS. - D
Apply a hierarchical firewall policy at the
Organizationlevel to block SSH, and then override it atFolder-Bto allow SSH.
Show answer and explanation
Correct answer: B
Explanation
Hierarchical firewall policies are applied at various levels, such as the organization, folder, or project. To meet the requirement of configuring specific rules for Folder-A without affecting Folder-B, the policy should be applied directly at the Folder-A level. Applying the policy at the organization level would impact all child resources, including Folder-B, which does not meet the requirements.
- A. Incorrect.
This would block SSH and allow HTTPS for all resources across the organization, including
Folder-B, which does not meet the requirement. - B. Correct.
This setup applies the required rules specifically to
Folder-A, ensuring thatFolder-Bis not impacted. It is the correct solution. - C. Incorrect.
This would apply the rules to
Folder-B, which is not required. The rules need to be applied toFolder-Ainstead. - D. Incorrect.
Overriding policies at
Folder-Bis unnecessary because the requirement is to apply rules only toFolder-A. This does not align with the scenario.