Google Professional Cloud Network Engineer Question 384
Single answerGoogle Cloud PlatformYou are a Cloud Network Engineer managing a Google Cloud environment for a company. The company wants to allow its internal applications to access a third-party API hosted on 'api.example.com' while blocking all other external traffic. You decide to use an FQDN-based firewall rule to achieve this. What step must you take to ensure that the FQDN firewall rule functions correctly?
- A
Enable Private Google Access on the subnet where the instances are located.
- B
Ensure that the Compute Engine instances are using Google Cloud DNS Resolver for DNS queries.
- C
Use an IP-based firewall rule instead of an FQDN rule because FQDN rules do not support third-party domains.
- D
Set up a Cloud NAT to ensure connectivity to 'api.example.com'.
Show answer and explanation
Correct answer: B
Explanation
To use FQDN firewall rules, the DNS resolution must be performed by Google Cloud's DNS Resolver. This ensures that the domain name can be matched to the firewall rule. Without this, the FQDN rule will not work, even if the domain is valid. Other options, such as Private Google Access or Cloud NAT, are unrelated to FQDN-specific rules.
- A. Incorrect.
Private Google Access is used to access Google APIs from private IP addresses but is not relevant for FQDN firewall rules.
- B. Correct.
Google Cloud DNS Resolver must be used for FQDN firewall rules because the domain resolution needs to be performed by Google Cloud to match the FQDN in the firewall rule.
- C. Incorrect.
FQDN firewall rules support third-party domains, so this statement is incorrect.
- D. Incorrect.
Cloud NAT is used for providing internet access to private instances, but it is not directly related to the functionality of FQDN-based firewall rules.