Google Professional Cloud Network Engineer Question 735
Select 3Google Cloud PlatformYour company is using Cloud NGFW (Next-Generation Firewall) on Google Cloud to secure its network. Recently, some users reported that they are unable to access a specific web application running on a VM instance in a private subnet. Upon inspection, you notice that the application is behind a load balancer, and there is a Cloud NGFW rule allowing HTTP and HTTPS traffic to the load balancer's IP address. What steps should you take to troubleshoot this issue and allow access to the application?
- A
Verify that the Cloud NGFW rule's priority does not conflict with a higher-priority rule blocking traffic.
- B
Check whether the Cloud NGFW rule is using the correct target service account associated with the load balancer.
- C
Ensure that the VM instance has the proper firewall rules at the VPC level to allow traffic from the load balancer.
- D
Inspect the Cloud NGFW logs to verify whether the traffic is being dropped due to a misconfigured rule.
- E
Create a new Cloud NGFW rule with a lower priority to explicitly allow the traffic.
Show answer and explanation
Correct answers: A, C, D
Explanation
When troubleshooting Cloud NGFW issues, it is important to first check the rule priority to ensure that no higher-priority rules are blocking the traffic. Additionally, the VPC-level firewall rules for the VM instance must allow the traffic to reach the application. Cloud NGFW logs are a critical tool for identifying whether traffic is being dropped due to rule misconfigurations. These steps collectively help identify and resolve the issue without creating unnecessary or redundant rules.
- A. Correct.
Correct: If there is a higher-priority Cloud NGFW rule blocking traffic, the rule allowing HTTP/HTTPS may not be applied. Verifying rule priority is an essential troubleshooting step.
- B. Incorrect.
Incorrect: Cloud NGFW rules are not associated with service accounts. This does not apply to the scenario and does not help troubleshoot the issue.
- C. Correct.
Correct: Even if the Cloud NGFW rules are configured properly, the VM instance's VPC firewall rules must allow inbound traffic from the load balancer for the application to work.
- D. Correct.
Correct: Cloud NGFW logs provide key insights into whether the traffic is being dropped due to a rule misconfiguration, which can help identify the root cause.
- E. Incorrect.
Incorrect: Creating a new rule with a lower priority is not a recommended troubleshooting step in this case. Instead, the existing rules should be reviewed and corrected first.