A cloud engineer is deploying a custom-mode Virtual Private Cloud (VPC) network named `corp-vpc`. The application team requires ingress TCP traffic on port 8080 to be allowed on Compute Engine instances tagged with `backend` ONLY if the traffic originates from instances tagged with `frontend`. All other ingress traffic on port 8080 to `backend` instances must be explicitly blocked by a fallback rule. Which TWO actions must the engineer take when creating these firewall rules using `gcloud`? (Select TWO.)
- Configure `--target-tags=backend` and `--source-tags=frontend` on the ingress allow firewall rule.Cevap
- Assign a lower numerical priority value (such as 100) to the specific allow rule than the fallback deny rule priority (such as 1000).Cevap
- CAssign a higher numerical priority value (such as 1000) to the specific allow rule than the fallback deny rule priority (such as 100).
- DConfigure `--target-tags=frontend` and `--source-tags=backend` on the ingress allow firewall rule.
Cevap
The cloud engineer must configure `--target-tags=backend` and `--source-tags=frontend` for the ingress allow rule, and ensure the allow rule is assigned a lower numerical priority number (e.g., 100) than the fallback deny rule (e.g., 1000).
Google Cloud firewall rules evaluate from lowest priority number to highest. To ensure an allow rule overrides a default or explicit deny rule, the allow rule must be assigned a lower numerical priority (e.g., 100) compared to the deny rule (e.g., 1000). Additionally, for ingress traffic, `--target-tags` identifies destination instances (`backend`) that receive incoming connections, while `--source-tags` restricts allowed senders (`frontend`).
Adım Adım Çözüm
Anahtar Kavram
GCP VPC Firewall Rule Priority Ordering and Target/Source Tag Rules