Examkin

Soru

Zorluk: ZorManaging Networking Resources

A Cloud Operations team manages a production Compute Engine instance cluster in a custom Virtual Private Cloud (VPC) network named `prod-vpc` and subnet `prod-subnet-01` located in region `us-central1`. The instances operate without external IP addresses for security compliance. Administrators need to enable Cloud Ops Telemetry logging from these private instances while also permitting secure administrative SSH access through Identity-Aware Proxy (IAP) TCP forwarding. Existing custom ingress rules currently deny all incoming TCP traffic on port 22 with priority 1000. Which TWO `gcloud` configuration steps must the administrator execute to achieve these operational requirements?

  1. Run `gcloud compute networks subnets update prod-subnet-01 --region=us-central1 --enable-private-ip-google-access` to allow instances without public IP addresses to reach Google Cloud APIs and services.Cevap
  2. Run `gcloud compute firewall-rules create allow-iap-ssh --network=prod-vpc --direction=INGRESS --priority=950 --action=ALLOW --rules=tcp:22 --source-ranges=35.235.240.0/20` to permit IAP SSH traffic.Cevap
  3. C
    Run `gcloud compute networks subnets update prod-subnet-01 --enable-private-ip-google-access` without the region flag, allowing GCP auto-discovery to apply the configuration globally across all regions.
  4. D
    Run `gcloud compute firewall-rules create allow-iap-ssh --network=prod-vpc --direction=INGRESS --priority=65535 --action=ALLOW --rules=tcp:22 --source-ranges=0.0.0.0/0` to allow all external administrative ingress.

Cevap

The administrator must enable Private Google Access on the regional subnet specifying the us-central1 region and create an ingress firewall rule permitting TCP port 22 from source range 35.235.240.0/20 with a priority value lower than 1000 (such as 950).
Enabling Private Google Access on `prod-subnet-01` with `--region=us-central1` allows compute instances without public IPs to reach Cloud Logging APIs natively. Adding an ingress firewall rule for `35.235.240.0/20` on TCP port 22 with priority 950 correctly allows IAP SSH traffic because priority 950 takes precedence over the existing deny rule evaluated at priority 1000.

Adım Adım Çözüm

1
Enable Private Google Access for instances lacking public IP addresses.
Instances in `prod-subnet-01` gain private routing to Google Cloud APIs, enabling telemetry logging.
Subnets require the explicit `--region` flag when modified via `gcloud compute networks subnets update`.
2
Configure the VPC Firewall rule for Identity-Aware Proxy SSH forwarding.
Inbound TCP traffic on port 22 from IP range `35.235.240.0/20` is explicitly allowed.
GCP Firewall rules evaluate lower numerical priority values first. Priority 950 overrides the existing deny rule evaluated at priority 1000.

Anahtar Kavram

Managing VPC Subnet Private Access and Firewall Priority Rules
Bu soruyu puanla

Konular

Managing Networking Resources

Bu konudan daha fazla soru