Google Professional Cloud Network Engineer Question 459
Select 2Google Cloud PlatformYou are tasked with configuring a security policy for your Google Cloud environment to ensure that only HTTPS traffic is allowed to an application deployed in a Google Kubernetes Engine (GKE) cluster. The application is exposed through an external HTTP(S) load balancer. What steps should you take to achieve this using Google Cloud security policies?
- A
Create a Google Cloud Armor security policy and add a rule to allow only 'tcp:443' traffic.
- B
Attach the Google Cloud Armor security policy to the backend service of the HTTP(S) load balancer.
- C
Create a VPC firewall rule to deny all ingress traffic to the GKE nodes except on port 443.
- D
Update the GKE cluster's node pool to only accept traffic on port 443.
- E
Modify the backend configuration of the load balancer to allow only HTTPS traffic.
Show answer and explanation
Correct answers: A, B
Explanation
To restrict traffic to HTTPS for an application exposed through an HTTP(S) load balancer, you should use Google Cloud Armor security policies. These policies allow you to define specific rules for traffic filtering. By creating a policy with a rule to allow only 'tcp:443' traffic and attaching it to the backend service of the load balancer, you ensure that only HTTPS traffic reaches your application. This approach is more scalable and targeted compared to modifying the GKE cluster configuration or using VPC firewall rules.
- A. Correct.
Correct. Google Cloud Armor security policies can be used to define rules for allowing or denying traffic to your application. Adding a rule to allow 'tcp:443' ensures that only HTTPS traffic is permitted.
- B. Correct.
Correct. A Google Cloud Armor security policy must be attached to the backend service of the HTTP(S) load balancer for the policy to be enforced.
- C. Incorrect.
Incorrect. While VPC firewall rules are useful for controlling network-level ingress and egress, this scenario is better handled with a Google Cloud Armor security policy at the load balancer level.
- D. Incorrect.
Incorrect. Updating the GKE cluster's node pool configuration does not directly control traffic at the load balancer level and is not the recommended approach for restricting HTTPS traffic.
- E. Incorrect.
Incorrect. The backend configuration of the load balancer does not provide a mechanism to enforce HTTPS-only traffic; this is managed through the security policy.