Practice Test 3 | Google Cloud Certified Associate Cloud Engineer | Dumps | Mock Test
You need to allow traffic from specific virtual machines in ‘subnet-a’ network access to machines in ‘subnet-b’ without giving the entirety of subnet-a access. How can you accomplish this?
A. Create a firewall rule to allow traffic from resources with specific network tags, then assign the machines in subnet-a the same tags.
B. Relocate the subnet-a machines to a different subnet and give the new subnet the needed access.
C. Create a rule to deny all traffic to the entire subnet, then create a second rule with higher priority giving access to tagged VM’s in subnet-a.
D. You can only grant firewall access to an entire subnet and not individual VM’s inside.
Explanation:
Correct Answer A
A (Correct answer) – Create a firewall rule to allow traffic from resources with specific network tags, then assign the machines in subnet-a the same tags.
Network tags allow more granular access based on individually tagged instances – Instances by target tags: The firewall rule is applicable only to VMs if they have a matching network tag.
B – Relocate the subnet-a machines to a different subnet and give the new subnet the needed access.
This would give the entire subnet access which is against the requirements: allow traffic from specific virtual machines in ‘subnet-a’ network access to machines in ‘subnet-b’ without giving the entirety of subnet-a access.
C – Create a rule to deny all traffic to the entire subnet, then create a second rule with higher priority giving access to tagged VM’s in subnet-a.
Creating overlapping rules with higher priority might technically work, but since traffic defaults to denied if no rule is in place, this is unnecessary. Assigning rules and instances by tags is the best answer.
D – You can only grant firewall access to an entire subnet and not individual VM’s inside.
This is not true per answer A
Comments are closed, but trackbacks and pingbacks are open.