Google Professional Cloud Network Engineer Question 423
Select 2Google Cloud PlatformYou are configuring a backend service in Google Cloud to handle HTTP traffic served by a global HTTPS load balancer. The backend instances must allow traffic from the load balancer and health check probes from Google Cloud. Which firewall rules should you configure to ensure proper functionality?
- A
Create an ingress allow rule for TCP traffic from the load balancer’s external IP range on port 443.
- B
Create an ingress allow rule for traffic from 35.191.0.0/16 and 130.211.0.0/22 on the ports specified by the health checks.
- C
Create an egress allow rule for traffic to 35.191.0.0/16 and 130.211.0.0/22 on all ports.
- D
Create an ingress allow rule for traffic from the load balancer’s IP range on the ports specified by the backend service.
- E
Create an ingress allow rule for all traffic from 0.0.0.0/0 to the backend service.
Show answer and explanation
Correct answers: B, D
Explanation
To properly configure the backend service, you need to allow two types of traffic: (1) health check probes originating from Google Cloud’s health check IP ranges (35.191.0.0/16 and 130.211.0.0/22) on the ports specified for health checks, and (2) load balancer traffic on the ports defined by the backend service configuration. These rules ensure that the backend service can handle incoming requests and respond to health checks while maintaining security.
- A. Incorrect.
Incorrect. While traffic from the load balancer is necessary, the port specified here (443) is incorrect. Backend services typically require rules for the ports defined in their configuration, not necessarily port 443.
- B. Correct.
Correct. Google Cloud health checks originate from the IP ranges 35.191.0.0/16 and 130.211.0.0/22. Allowing traffic from these ranges on the health check ports is essential for the health check probes to work.
- C. Incorrect.
Incorrect. Health checks and load balancer traffic are inbound to the backend, so an egress rule is unnecessary for this scenario.
- D. Correct.
Correct. Traffic from the load balancer’s IP range must be allowed on the ports specified by the backend service, ensuring that the load balancer can forward traffic to the backend.
- E. Incorrect.
Incorrect. Allowing all traffic from 0.0.0.0/0 is overly permissive and violates security best practices. Firewall rules should be specific to required sources and ports.