Google Professional Cloud Network Engineer Question 424
Select 2Google Cloud PlatformYou are setting up a Google Cloud Load Balancer with a backend instance group. The backend services require health checks to ensure instances are healthy and can accept traffic. To allow health checks and external traffic to the backend services, which firewall rules should you define?
- A
A firewall rule to allow ingress traffic from 0.0.0.0/0 on the ports used by the backend services.
- B
A firewall rule to allow ingress traffic from the health check ranges provided by Google on the ports used for health checks.
- C
A firewall rule to allow egress traffic to 0.0.0.0/0 to ensure the backend instances can send traffic to any destination.
- D
A firewall rule to allow ingress traffic from the internal IP ranges of other Google Cloud resources on all ports.
- E
A firewall rule to allow ingress traffic from the health check ranges provided by Google on all ports.
Show answer and explanation
Correct answers: A, B
Explanation
To enable traffic and health checks for backend services, you need to define firewall rules that: (1) allow external clients to access the backend services on the appropriate ports, and (2) allow Google Cloud's health check probes to reach the backend instances on the ports used for health checks. Both rules ensure proper functionality of the Load Balancer while adhering to security best practices by limiting access to specific sources and ports.
- A. Correct.
This rule ensures that external clients can access the backend services through the Load Balancer. It is necessary to allow traffic on the ports used by the backend services.
- B. Correct.
This rule specifically allows health check probes from Google Cloud's health check ranges to access the backend instances on the ports used for health checks. This is critical for ensuring the Load Balancer detects healthy instances.
- C. Incorrect.
While egress traffic may be necessary for other use cases, it is unrelated to enabling health checks or allowing traffic to backend services.
- D. Incorrect.
This rule might allow internal traffic, but it is irrelevant to the health checks or external client traffic required for the Load Balancer.
- E. Incorrect.
Allowing health checks on all ports is overly permissive and not a best practice. Health checks should be restricted to the specific ports they use to avoid unnecessary exposure.