Google Professional Cloud Network Engineer Question 382
Select 3Google Cloud PlatformYour company has a Google Cloud project where you need to allow outbound HTTP and HTTPS traffic only to specific external domains: 'example.com' and 'api.example.net'. You want to achieve this using FQDN-based firewall rules while minimizing the risk of accidental exposure to other domains. Which steps should you take to implement this correctly?
- A
Create a firewall rule using the 'FQDN' target type and specify 'example.com' and 'api.example.net' as the allowed domains.
- B
Ensure that the private Google Access service is enabled for the VPC network.
- C
Set the firewall rule direction to 'Egress' and specify the ports for HTTP (80) and HTTPS (443).
- D
Use the 'Network Tags' feature to apply the firewall rule only to instances that require access to the specified domains.
- E
Define a firewall rule with an IP-based target range instead of FQDNs, as FQDN objects are not supported in egress firewall rules.
Show answer and explanation
Correct answers: A, C, D
Explanation
To implement FQDN-based firewall rules, you need to create an egress rule that specifies the required domains using the FQDN target type. Additionally, specifying the appropriate ports for HTTP (80) and HTTPS (443) ensures that only intended traffic is allowed. Using network tags to apply the rule to specific instances further tightens security by minimizing the scope of the rule. Private Google Access and IP-based target ranges are not relevant to this scenario.
- A. Correct.
Correct: Google Cloud supports FQDN-based firewall objects for egress rules, allowing you to specify fully qualified domain names like 'example.com' and 'api.example.net'.
- B. Incorrect.
Incorrect: While private Google Access is useful for granting access to Google APIs and services, it is unrelated to implementing FQDN-based firewall rules.
- C. Correct.
Correct: Egress rules are used to manage outbound traffic, and specifying the HTTP and HTTPS ports ensures that only the intended types of traffic are allowed.
- D. Correct.
Correct: Using network tags ensures that the firewall rule applies only to the necessary instances, reducing the risk of misconfiguration or unintended access.
- E. Incorrect.
Incorrect: Google Cloud does support FQDN objects in egress firewall rules, making this statement inaccurate.