Refer to the exhibit. An engineer must provide HTTPS access from the Google Cloud Platform virtual machine to the on-premises mail server. All other connections from the virtual machine to the mail…

Question

Exhibit

Options

• ASet IP address 192.168.200.10 as the destination in rule 1.
• BMove up rule 2.
• CSet IP address 20.1.1.1 as the source in rule 1.
• DConfigure a NAT rule.
• EConfigure a security group.

• A
  61% (36)
• B
  5% (3)
• C
  20% (12)
• E
  14% (8)

Explanation

Fixing rule 1's destination to 192.168.200.10 (the mail server's on-premises IP) ensures the HTTPS permit rule targets the correct host, rather than applying too broadly or not matching at all - without this, the rule never matches traffic destined for the mail server. Adding a NAT rule is necessary because the GCP virtual machine uses a private cloud IP that is not routable on the on-premises network; NAT translates the source address so the firewall and mail server can properly forward and return traffic.

B is wrong because moving rule 2 does not fix the misconfigured destination in rule 1 - reordering rules cannot correct a rule that is matching the wrong traffic in the first place. C is wrong because setting 20.1.1.1 as the source would restrict the rule to that specific IP, but the core problem is the missing destination specification, not the source; correcting the destination (A) is what enables the match. E is wrong because security groups are an AWS/GCP-native construct layered on instances, not a firewall rule fix - the question is asking about the perimeter firewall, where NAT and ACL destination fixes are the appropriate tools.

Memory tip: Think "destination + translation" - firewall permit rules need to know where traffic is going (correct destination IP), and cross-network traffic (cloud → on-premises) almost always needs NAT to bridge the address spaces.

No community discussion yet for this question.