Google Professional Cloud Network Engineer Question 421
Select 2Google Cloud PlatformYou are configuring a Google Cloud Load Balancer to serve traffic to backend instances. The instances are part of a managed instance group, and you need to ensure that both customer traffic and health check probes from the load balancer can reach the backend instances. Which of the following firewall rules should you configure?
- A
An ingress rule allowing traffic from 0.0.0.0/0 to the backend instances on the configured load balancer port.
- B
An ingress rule allowing traffic from the load balancer’s health check IP ranges to the backend instances on the health check port.
- C
An egress rule allowing traffic to 0.0.0.0/0 from the backend instances on any port.
- D
An ingress rule allowing traffic from the backend instance group’s private IP range to itself on all ports.
- E
An ingress rule allowing traffic from the load balancer’s IP ranges to the backend instances on the configured load balancer port.
Show answer and explanation
Correct answers: B, E
Explanation
To configure the firewall for a Google Cloud Load Balancer, you need two key ingress rules: one to allow traffic from the load balancer's health check IP ranges to the backend instances (on the health check port) and another to allow traffic from the load balancer's IP ranges to the backend instances (on the configured load balancer port). These rules ensure that both health checks and customer traffic can reach the backend services while maintaining security.
- A. Incorrect.
This rule is overly permissive and allows traffic from any source (0.0.0.0/0), which is not secure. It does not specifically address traffic from the load balancer or health checks.
- B. Correct.
This rule is correct as it explicitly allows traffic from the load balancer’s health check IP ranges to the backend instances on the health check port, ensuring health checks function correctly.
- C. Incorrect.
This is an egress rule, but the scenario requires ingress rules. Egress rules are not relevant for allowing traffic to backend instances or health checks in this context.
- D. Incorrect.
This rule is unnecessary because the backend instances do not directly communicate with each other for this use case. The scenario focuses on allowing traffic from the load balancer and health checks.
- E. Correct.
This rule is correct as it allows traffic from the load balancer’s IP ranges to reach the backend instances, ensuring customer traffic can flow to the backend instances on the configured load balancer port.