Topic 1 Question 206
You have two subnets (subnet-a and subnet-b) in the default VPC. Your database servers are running in subnet-a. Your application servers and web servers are running in subnet-b. You want to configure a firewall rule that only allows database traffic from the application servers to the database servers. What should you do?
• Create service accounts sa-app and sa-db. • Associate service account sa-app with the application servers and the service account sa-db with the database servers. • Create an ingress firewall rule to allow network traffic from source service account sa-app to target service account sa-db.
• Create network tags app-server and db-server. • Add the app-server tag to the application servers and the db-server tag to the database servers. • Create an egress firewall rule to allow network traffic from source network tag app-server to target network tag db-server.
• Create a service account sa-app and a network tag db-server. • Associate the service account sa-app with the application servers and the network tag db-server with the database servers. • Create an ingress firewall rule to allow network traffic from source VPC IP addresses and target the subnet-a IP addresses.
• Create a network tag app-server and service account sa-db. • Add the tag to the application servers and associate the service account with the database servers. • Create an egress firewall rule to allow network traffic from source network tag app-server to target service account sa-db.
ユーザの投票
コメント(13)
- 正解だと思う選択肢: B
Service account? It doesn't make any sense. It's clearly a firewall solution.
👍 3georgesouzafarias2023/06/23 - 正解だと思う選択肢: B
Even though you could use service accounts for firewall rules, why is B wrong? It seems to do what the question requests and is the standard method.
👍 3juliorevk2023/08/03 - 正解だと思う選択肢: A
Both service accounts and network tags can be used for creating a Cloud Firewall rule. The prime word is "to allow network traffic from app server to database server" which is achievable by inbound/ingress rule and not egress rule. https://cloud.google.com/firewall/docs/firewalls#rule_assignment
👍 3scanner22023/09/03
シャッフルモード