Google Professional Cloud Network Engineer Question 457
Select 3Google Cloud PlatformYour organization has a requirement to ensure that internal application instances in Google Cloud can only communicate with each other over specific ports, while blocking all other traffic. The application instances are hosted in a VPC with multiple subnets. You want to implement this using Google Cloud security policies. Which steps should you take to meet this requirement?
- A
Create a VPC firewall rule with a priority of 1000 to allow traffic on the specific ports and apply it to the application instances' target tags.
- B
Create a VPC firewall rule with a priority of 2000 to deny all traffic and apply it to the application instances' target tags.
- C
Use Identity and Access Management (IAM) roles to restrict the port-level access for internal communication.
- D
Create a Google Cloud Armor policy to allow traffic only on the specific ports and apply it to the VPC network.
- E
Ensure the firewall rules are applied in the correct priority order, with allow rules for the specific ports having a higher priority than deny rules.
Show answer and explanation
Correct answers: A, B, E
Explanation
To restrict internal communication in a VPC to specific ports, you need to configure VPC firewall rules. First, create an allow rule for the specific ports with a higher priority to enable the required traffic. Then, create a deny-all rule with a lower priority to block all other traffic. Ensure that the rules are applied in the correct priority order to enforce the desired security policies effectively. IAM roles and Google Cloud Armor are not suitable for this use case because they do not operate at the network level within a VPC.
- A. Correct.
Correct: Creating a firewall rule to allow traffic on specific ports ensures that the required communication is permitted between application instances.
- B. Correct.
Correct: Creating a deny-all firewall rule ensures that all other traffic is blocked, which fulfills the security requirement to block unwanted communication.
- C. Incorrect.
Incorrect: IAM roles are used for managing access to Google Cloud resources, not for restricting network-level communication.
- D. Incorrect.
Incorrect: Google Cloud Armor is used for protecting applications from external threats. It is not designed to manage internal traffic within a VPC.
- E. Correct.
Correct: The priority order of firewall rules is critical for their effectiveness. Allow rules for specific ports should have a higher priority than deny-all rules to ensure intended traffic is not inadvertently blocked.