Google Professional Cloud Network Engineer Question 420
Select 2Google Cloud PlatformYou are configuring a Google Cloud Load Balancer to serve traffic to a backend service hosted on Compute Engine instances. To ensure proper operation, you need to define firewall rules that allow both user traffic and health check probes to reach the backend instances. Which of the following firewall rules should you configure?
- A
A rule allowing TCP traffic on port 80 from the 0.0.0.0/0 CIDR block
- B
A rule allowing HTTPS traffic on port 443 from the 0.0.0.0/0 CIDR block
- C
A rule allowing TCP traffic from the Google Cloud health check source ranges on the health check port
- D
A rule allowing ICMP traffic from the Google Cloud health check source ranges
- E
A rule allowing traffic from the internal VPC subnet on all ports
Show answer and explanation
Correct answers: A, C
Explanation
To ensure proper operation of a Google Cloud Load Balancer, you must allow both user traffic and health check probes to reach the backend instances. User traffic typically involves HTTP or HTTPS, depending on the backend configuration. Health checks require specific firewall rules that allow traffic from the Google Cloud health check source ranges to the health check port. Other types of traffic, such as ICMP or internal VPC traffic, are not relevant to this scenario.
- A. Correct.
This rule allows HTTP traffic (on port 80) from all public IP addresses, which is necessary for user traffic when the backend service is serving web content over HTTP.
- B. Incorrect.
This rule is not required unless your backend service is specifically configured to serve HTTPS traffic on port 443. Since the question doesn't mention HTTPS, this rule is unnecessary.
- C. Correct.
This rule is required because Google Cloud health checks originate from specific source IP ranges, and their traffic must be allowed to reach the health check port of your backend service.
- D. Incorrect.
Health checks in Google Cloud do not use ICMP; they typically use TCP, HTTP, or HTTPS. This rule is unnecessary.
- E. Incorrect.
This rule is not directly applicable to the scenario since the question focuses on external traffic and health checks, not internal VPC communication.