Google Professional Cloud Network Engineer Question 456
Select 3Google Cloud PlatformYou are tasked with configuring security policies in Google Cloud to restrict external access to a virtual machine (VM) while allowing only internal traffic from a specific subnet. Which steps should you take to achieve this configuration?
- A
Create a firewall rule with a priority value lower than the default rule to deny ingress traffic from 0.0.0.0/0.
- B
Create a firewall rule to allow ingress traffic from the specific subnet's IP range.
- C
Set the target of the firewall rules to include the VM's network tag.
- D
Enable VPC Service Controls on the VM to restrict external access.
- E
Create an egress firewall rule to deny all traffic from the VM to 0.0.0.0/0.
Show answer and explanation
Correct answers: A, B, C
Explanation
To restrict external access to a VM while allowing internal traffic from a specific subnet, you need to deny ingress traffic from all external sources (0.0.0.0/0) using a higher-priority firewall rule. Additionally, you must explicitly allow ingress traffic from the specific subnet's IP range. Applying a network tag to the VM and targeting the firewall rules to this tag ensures the rules apply consistently to the intended resource. VPC Service Controls and egress rules are not relevant for this specific ingress restriction scenario.
- A. Correct.
This is correct because a firewall rule with a lower priority and a deny action can restrict unwanted ingress traffic, such as external access from 0.0.0.0/0.
- B. Correct.
This is correct because allowing ingress traffic from the specific subnet's IP range ensures that internal traffic to the VM is permitted.
- C. Correct.
This is correct because applying a network tag to the VM and targeting the firewall rules to this tag ensures the rules are applied specifically to the VM.
- D. Incorrect.
This is incorrect because VPC Service Controls are primarily used for data exfiltration prevention and managing access to Google-managed resources, not restricting external traffic to a VM.
- E. Incorrect.
This is incorrect because an egress firewall rule does not control ingress traffic, which is the focus of this scenario.