Google Professional Cloud Network Engineer Question 455
Select 3Google Cloud PlatformYou are managing a Google Cloud project for a company that hosts a web application. The application is deployed in a VPC with multiple subnets. To meet the security requirements, you must configure a security policy that denies external SSH access to all virtual machines but allows internal SSH access within the VPC. Which steps should you take to configure the correct security policy?
- A
Create an ingress firewall rule with a priority of 1000 that denies TCP traffic on port 22 from source 0.0.0.0/0.
- B
Create an ingress firewall rule with a priority of 100 that allows TCP traffic on port 22 from source 10.0.0.0/8.
- C
Ensure that the deny rule has a priority lower (higher number) than the allow rule.
- D
Ensure that the allow rule has a priority lower (higher number) than the deny rule.
- E
Apply the firewall rules to all instances in the network.
Show answer and explanation
Correct answers: A, B, D
Explanation
To correctly configure the security policy, you need to deny external SSH access while allowing internal SSH access. This is achieved by creating two firewall rules: one to deny TCP traffic on port 22 from external sources (e.g., 0.0.0.0/0) and another to allow TCP traffic on port 22 from internal sources (e.g., 10.0.0.0/8). The allow rule should have a higher priority (lower number) than the deny rule to ensure internal traffic is permitted before the external deny rule is evaluated. These rules should be applied at the VPC level and not directly to individual instances.
- A. Correct.
Correct. Denying external access to TCP port 22 from 0.0.0.0/0 prevents any SSH access from external networks.
- B. Correct.
Correct. Allowing SSH access from internal IP ranges (e.g., 10.0.0.0/8) ensures that SSH can still work within the VPC.
- C. Incorrect.
Incorrect. A deny rule with a higher priority (lower number) would override the allow rule, which is not the desired behavior in this scenario.
- D. Correct.
Correct. The allow rule must have a higher priority (lower number) than the deny rule to ensure internal SSH access is permitted before external access is denied.
- E. Incorrect.
Incorrect. Firewall rules in Google Cloud are applied at the VPC level, not directly on instances. However, tags or service accounts can be used for more granular targeting.