Google Professional Cloud Network Engineer Question 380
Single answerGoogle Cloud PlatformYou are configuring a firewall rule in Google Cloud to allow outbound HTTPS traffic from your Virtual Machine to a third-party API service. The third-party service has provided you with their FQDN (e.g., api.thirdparty.com) instead of an IP address. What must you do to correctly implement this rule?
- A
Use the FQDN directly in the 'Destination IP Ranges' field of the firewall rule.
- B
Create an FQDN-based firewall object for the third-party service's domain and use it in the firewall rule.
- C
Configure a static external IP address for the VM and allow only that IP to communicate with
api.thirdparty.com. - D
Use Google Cloud's built-in DNS resolver to convert the FQDN to an IP address and manually add the IP to the 'Destination IP Ranges' field.
Show answer and explanation
Correct answer: B
Explanation
To allow traffic to an FQDN in Google Cloud, you must use an FQDN-based firewall object. These objects dynamically resolve the FQDN to IP addresses and ensure that your firewall rule stays valid even if the underlying IP address changes. This approach is both reliable and scalable compared to manually managing IP addresses.
- A. Incorrect.
FQDNs cannot be directly used in the 'Destination IP Ranges' field of a firewall rule. Google Cloud requires FQDN firewall objects to handle FQDNs.
- B. Correct.
This is the correct answer. Google Cloud allows you to create FQDN-based firewall objects that can resolve and target FQDNs dynamically. You can then use this object in your firewall rule.
- C. Incorrect.
Configuring a static external IP for the VM does not solve the problem of allowing outbound traffic to an FQDN. This option is unrelated to the use of FQDN-based firewall objects.
- D. Incorrect.
Manually resolving the FQDN to an IP and adding it to the firewall rule is not a recommended approach. IP addresses may change over time, and Google Cloud's FQDN-based firewall objects are designed to handle this dynamically.