Examkin

Soru

Zorluk: OrtaDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A security team requires that incoming HTTP (port 80) traffic be allowed strictly to Compute Engine virtual machines that have the `web-server` network tag assigned, within a custom VPC network named `prod-vpc`. The rule must take precedence over default VPC firewall rules (which have a priority of 65534), while leaving priority values below 1000 reserved for future emergency overrides. Which command should a cloud engineer execute to fulfill this requirement?

  1. gcloud compute firewall-rules create allow-web-http --network=prod-vpc --direction=INGRESS --priority=1000 --allow=tcp:80 --target-tags=web-serverCevap
  2. B
    gcloud compute firewall-rules create allow-web-http --network=prod-vpc --direction=INGRESS --priority=65535 --allow=tcp:80 --target-tags=web-server
  3. C
    gcloud projects add-iam-policy-binding prod-project --member=serviceAccount:[email protected] --role=roles/owner
  4. D
    gcloud resource-manager folders add-iam-policy-binding 1234567890 --member=allAuthenticatedUsers --role=roles/viewer

Cevap

Execute the command: gcloud compute firewall-rules create allow-web-http --network=prod-vpc --direction=INGRESS --priority=1000 --allow=tcp:80 --target-tags=web-server
In Google Cloud VPC networking, firewall rules determine packet filtering. Priority numbers range from 0 to 65535, where lower numbers have higher precedence. A priority of 1000 ensures the rule evaluates before the default allow/deny rules (priority 65534) and leaves lower priority numbers available for emergency rules. Specifying `--direction=INGRESS`, `--allow=tcp:80`, and `--target-tags=web-server` correctly restricts incoming HTTP traffic to tagged instances.

Adım Adım Çözüm

1
Identify the required network filtering mechanism
GCP Virtual Private Cloud (VPC) Firewall Rules must be used to filter network traffic based on protocols, ports, and network tags.
IAM roles and resource hierarchy policies control control-plane access, not data-plane network packet filtering.
2
Evaluate priority ordering in Google Cloud VPC Firewall Rules
Lower priority numbers represent higher precedence (0 is highest, 65535 is lowest).
Setting the priority to 1000 ensures it evaluates before default rules (priority 65534) while keeping priority range 0–999 open for emergency overrides.
3
Select the proper CLI parameters for ingress traffic filtering
Use '--direction=INGRESS', '--allow=tcp:80', '--target-tags=web-server', and '--network=prod-vpc'.
This precisely restricts inbound web traffic to VM instances matching the specified target tag within the target VPC.

Anahtar Kavram

VPC Firewall Rule Priority and Tag Targeting
Bu soruyu puanla

Konular

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules