Google Professional Cloud Network Engineer Question 422
Select 2Google Cloud PlatformYou are configuring a Google Cloud Load Balancer with an instance group as the backend. The backend services require health checks to ensure traffic is only sent to healthy instances. Which firewall rules must you define to ensure both traffic and health checks are allowed?
- A
Allow ingress traffic on ports specified in the health check to the backend instances from Google health checker IP ranges.
- B
Allow egress traffic from the backend instances to 0.0.0.0/0 on the health check ports.
- C
Allow ingress traffic from 0.0.0.0/0 on all ports to the backend instances.
- D
Allow ingress traffic to the backend instances on ports specified in the load balancer's forwarding rule.
- E
Allow ingress traffic only from private IP ranges (RFC 1918) on ports specified in the health check.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure proper functioning of a Google Cloud Load Balancer, you need to configure firewall rules to allow ingress traffic for both health checks and user traffic. Specifically, this involves allowing traffic from Google health checker IP ranges on the health check ports and allowing traffic on the ports specified in the load balancer's forwarding rule. Configuring these rules ensures that the health checks succeed and the load balancer can route user traffic to the backend instances.
- A. Correct.
This is correct. Google Cloud health checks require ingress rules to allow traffic from specific Google health checker IP ranges to the backend instances on the health check ports.
- B. Incorrect.
This is incorrect. Health checks do not require egress rules from backend instances; they only need ingress rules to allow traffic from Google health checker IP ranges.
- C. Incorrect.
This is incorrect. Allowing all traffic from 0.0.0.0/0 is not secure and does not align with best practices for firewall rules.
- D. Correct.
This is correct. You must allow ingress traffic to the backend instances on the ports specified in the load balancer's forwarding rule to enable proper routing of user traffic.
- E. Incorrect.
This is incorrect. Health checks are performed by Google health checker IP ranges, not limited to private IP ranges as defined by RFC 1918.