A Cloud Operations team manages a custom Virtual Private Cloud (VPC) network named `finance-vpc`. A system administrator is tasked with updating an existing ingress firewall rule named `allow-db-ingress` so that it allows incoming TCP traffic on port 5432, targets Compute Engine instances with the network tag `db-node`, and evaluates at a priority level of 200. Additionally, the administrator must verify the updated configuration details using the Google Cloud CLI. Which TWO steps should the administrator take to complete these operations?
- Run `gcloud compute firewall-rules update allow-db-ingress --allow=tcp:5432 --target-tags=db-node --priority=200` to modify the existing rule attributes.Cevap
- Run `gcloud compute firewall-rules describe allow-db-ingress` to review the details and confirm the effective configuration of the updated rule.Cevap
- CRun `gcloud compute firewall-rules update allow-db-ingress --allow=tcp:5432 --source-tags=db-node --priority=200` to filter ingress target workloads in the VPC.
- DAdjust the priority parameter to 1000 so that this rule evaluates before existing rules set to priority 200.
Cevap
The administrator must update the rule using `gcloud compute firewall-rules update allow-db-ingress --allow=tcp:5432 --target-tags=db-node --priority=200` and verify the updated configuration using `gcloud compute firewall-rules describe allow-db-ingress`.
Updating an ingress firewall rule to target specific destination workloads requires using `--target-tags` along with the desired allowed ports and priority integer. To audit and confirm the changes, executing `gcloud compute firewall-rules describe` outputs the exact JSON/YAML spec of the deployed resource.
Adım Adım Çözüm
Anahtar Kavram
VPC Firewall Rule Management and Evaluation Logic