Google Professional Cloud Architect Exam - Topic 13 Question 40 Discussion

Actual exam question for Google's Professional Cloud Architect exam

Question #: 40
Topic #: 13

[All Professional Cloud Architect Questions]

All compute Engine instances in your VPC should be able to connect to an Active Directory server on specific ports. Any other traffic emerging from your instances is not allowed. You want to enforce this using VPC firewall rules.

How should you configure the firewall rules?

ACreate an egress rule with priority 1000 to deny all traffic for all instances. Create another egress rule with priority 100 to allow the Active Directory traffic for all instances.

BCreate an egress rule with priority 100 to deny all traffic for all instances. Create another egress rule with priority 1000 to allow the Active Directory traffic for all instances.

CCreate an egress rule with priority 1000 to allow the Active Directory traffic. Rely on the implied deny
egress rule with priority 100 to block all traffic for all instances.

DCreate an egress rule with priority 100 to allow the Active Directory traffic. Rely on the implied deny egress rule with priority 1000 to block all traffic for all instances.

Show Suggested Answer

Suggested Answer: B

https://cloud.google.com/vpc/docs/firewalls

by Jose at May 03, 2022, 09:44 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Architect Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Leatha

5 months ago

Not sure about that, but I feel like D could work too.

upvoted 0 times

...

Hildred

5 months ago

I agree with C, it’s cleaner to allow specific traffic.

upvoted 0 times

...

Valentin

5 months ago

Wait, why would you deny all first? That sounds risky.

upvoted 0 times

...

Marva

5 months ago

I think B is the way to go, denying first makes more sense.

upvoted 0 times

...

Leota

5 months ago

Option C seems right, allow AD traffic and let the deny do its job.

upvoted 0 times

...

Lashanda

5 months ago

I’m leaning towards option A because it clearly denies all traffic first, but I’m worried I might be mixing up the priorities from other examples we did.

upvoted 0 times

...

Lauran

5 months ago

I feel like option C makes sense since it allows the specific traffic and relies on the implied deny, but I'm not completely confident about the priority numbers.

upvoted 0 times

...

Corazon

5 months ago

I remember practicing a similar question where the priority of the deny rule was crucial. I think it should be higher than the allow rule to block everything else.

upvoted 0 times

...

Veta

5 months ago

I think we need to allow the Active Directory traffic first, but I'm not sure if the priority should be higher or lower for that rule.

upvoted 0 times

...

Harris

6 months ago

Hmm, I'm not entirely sure about this one. The image doesn't give a lot of detail, and I'm not very familiar with the MX Security Appliance. I'll have to think this through carefully and try to eliminate the options that don't seem to fit.

upvoted 0 times

...

Lajuana

6 months ago

Okay, I'm pretty confident the answer is B. "Can Grow". That property sounds like it would let the control resize itself to fit the content, which is what the question is asking about. I'm going to go with that one.

upvoted 0 times

...

Felice

6 months ago

This is a straightforward one. The requirements are clear - we need to ensure the 'Cannot Complete' status can't be changed in a way that would impact the history tracking. I've got this.

upvoted 0 times

...

Arlyne

6 months ago

Hmm, Phase 2 was from 1987-1993. I need to recall which of these was established outside that timeframe.

upvoted 0 times

...

Esteban

6 months ago

I practiced similar problems and I might be leaning towards "13.33%." I remember it having something to do with determining percentages in financial ratios.

upvoted 0 times

...