Examkin

Soru

Zorluk: OrtaManaging Networking Resources

A cloud engineer is operating a VPC network named `prod-vpc` where a high-priority ingress firewall rule named `block-external-ingress` with priority `1000` denies all incoming traffic from external networks. The engineer needs to configure firewall access to allow Google Cloud load balancer health check probes (`35.191.0.0/16` and `130.211.0.0/22`) to reach backend instances tagged as `web-backend` over TCP port 80. Which `gcloud` command should the engineer run to ensure the health check probes are successfully evaluated and permitted?

  1. gcloud compute firewall-rules create allow-health-checks --network=prod-vpc --action=ALLOW --direction=INGRESS --source-ranges=35.191.0.0/16,130.211.0.0/22 --target-tags=web-backend --rules=tcp:80 --priority=500Cevap
  2. B
    gcloud compute firewall-rules create allow-health-checks --network=prod-vpc --action=ALLOW --direction=INGRESS --source-ranges=35.191.0.0/16,130.211.0.0/22 --target-tags=web-backend --rules=tcp:80 --priority=2000
  3. C
    gcloud compute firewall-rules create allow-health-checks --network=prod-vpc --action=ALLOW --direction=INGRESS --destination-ranges=35.191.0.0/16,130.211.0.0/22 --target-tags=web-backend --rules=tcp:80 --priority=500
  4. D
    gcloud compute firewall-rules create allow-health-checks --network=prod-vpc --action=ALLOW --direction=INGRESS --source-ranges=35.191.0.0/16,130.211.0.0/22 --target-tags=web-backend --rules=udp:80 --priority=500

Cevap

Execute the `gcloud compute firewall-rules create` command specifying `--action=ALLOW`, `--direction=INGRESS`, `--source-ranges=35.191.0.0/16,130.211.0.0/22`, `--rules=tcp:80`, and a priority number lower than 1000 (such as 500).
The correct command uses `--priority=500` which evaluates before the existing `--priority=1000` deny rule because lower numbers take precedence in GCP firewall rule ordering. Additionally, it accurately uses `--source-ranges` to specify probe IP origins and `--rules=tcp:80` for the health check protocol.

Adım Adım Çözüm

1
Analyze GCP firewall priority ordering rules.
GCP evaluates firewall rules starting from the lowest numerical priority (0) to the highest (65535). The first matching rule applies.
Because an existing rule denies traffic at priority 1000, any new rule intended to permit health checks must have a priority number strictly less than 1000.
2
Identify mandatory parameter flags for ingress health check probes.
Ingress traffic filters require `--direction=INGRESS` and `--source-ranges` containing the Google Cloud health check IP blocks `35.191.0.0/16` and `130.211.0.0/22`.
Health check probes originate from these known IP blocks and target backend instances via TCP.
3
Construct the exact `gcloud compute firewall-rules create` syntax.
Setting `--priority=500`, `--rules=tcp:80`, `--target-tags=web-backend`, and `--source-ranges=35.191.0.0/16,130.211.0.0/22` permits the probes before reaching the priority 1000 deny rule.
This guarantees health check packets pass successfully to the instance instances.

Anahtar Kavram

VPC Firewall Rule Priority and Health Check Ingress Configuration
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Managing Networking Resources

Bu konudan daha fazla soru