Google Professional Cloud Network Engineer Question 381
Single answerGoogle Cloud PlatformYour organization hosts a set of applications in Google Cloud that need to communicate with specific external web services via HTTPS. Security policy mandates that these external services should be allowed only by their fully qualified domain names (FQDNs) to ensure strict control over outbound traffic. How should you configure a firewall rule in Google Cloud to achieve this requirement?
- A
Use a firewall rule with FQDN-based target tags in the 'targetTags' field.
- B
Create a firewall rule with an FQDN firewall object in the 'destination' field.
- C
Use a custom URL map in a load balancer to filter traffic based on the FQDN.
- D
Create a firewall rule with the 'allow' action and specify the required FQDN under the 'rules' section.
Show answer and explanation
Correct answer: B
Explanation
To control outbound traffic to specific external web services based on their fully qualified domain names (FQDNs), Google Cloud supports FQDN-based firewall objects. These objects can be specified in the 'destination' field of a firewall rule, enabling precise traffic filtering. Other options like 'targetTags', URL maps, or generic 'allow' actions do not support FQDNs in this context, making option 2 the correct choice.
- A. Incorrect.
Incorrect: The 'targetTags' field in a firewall rule is used to define instances or resources to which the rule applies, not FQDNs.
- B. Correct.
Correct: Google Cloud supports FQDN-based firewall objects, which can be used in the 'destination' field of a firewall rule to control outbound traffic to specific domains.
- C. Incorrect.
Incorrect: URL maps in load balancers are used for routing HTTP(S) traffic, not for defining firewall rules or controlling outbound traffic based on FQDNs.
- D. Incorrect.
Incorrect: While the 'allow' action in a firewall rule specifies permitted traffic, FQDNs cannot be directly added under the 'rules' section. They must be defined as FQDN-based objects.