Question 235 of 318
Single answerYou control network traffic for a folder in your Google Cloud environment. Your folder includes multiple projects and Virtual Private Cloud (VPC) networks. You want to enforce on the folder level that egress connections are limited only to IP range 10.58.5.0/24 and only from the VPC network “dev-vpcâ€. You want to minimize implementation and maintenance effort.
What should you do?
A1. Leave the network configuration of the VMs in scope unchanged.
2. Create a new project including a new VPC network “new-vpcâ€.
3. Deploy a network appliance in “new-vpc†to filter access requests and only allow egress connections from “dev-vpc†to 10.58.5.0/24.
2. Create a new project including a new VPC network “new-vpcâ€.
3. Deploy a network appliance in “new-vpc†to filter access requests and only allow egress connections from “dev-vpc†to 10.58.5.0/24.
B1. Leave the network configuration of the VMs in scope unchanged.
2. Enable Cloud NAT for “dev-vpc†and restrict the target range in Cloud NAT to 10.58.5.0/24.
2. Enable Cloud NAT for “dev-vpc†and restrict the target range in Cloud NAT to 10.58.5.0/24.
✓C1. Attach external IP addresses to the VMs in scope.
2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.
2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.
D1. Attach external IP addresses to the VMs in scope.
2. Configure a VPC Firewall rule in “dev-vpc†that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.
2. Configure a VPC Firewall rule in “dev-vpc†that allows egress connectivity to IP range 10.58.5.0/24 for all source addresses in this network.
✓
Correct Answer: C
1. Attach external IP addresses to the VMs in scope.<br>2. Define and apply a hierarchical firewall policy on folder level to deny all egress connections and to allow egress to IP range 10.58.5.0/24 from network dev-vpc.
▥
Explanation
The correct answer is highlighted above. Review the wording carefully, then use the next question to continue building your understanding of Google certification topics.