nerdexam
Google

PROFESSIONAL-CLOUD-NETWORK-ENGINEER · Question #138

Your company's security team wants to limit the type of inbound traffic that can reach your web servers to protect against security threats. You need to configure the firewall rules on the web…

The correct answer is C. Create an allow on match ingress firewall rule with the target tag "web-server" to allow all IP. To restrict inbound web server traffic to HTTP and HTTPS, an ingress firewall rule must be configured to allow TCP ports 80 and 443 from all source IP addresses, targeting the web servers.

Submitted by jaden.t· Apr 18, 2026Implementing network security

Question

Your company's security team wants to limit the type of inbound traffic that can reach your web servers to protect against security threats. You need to configure the firewall rules on the web servers within your Virtual Private Cloud (VPC) to handle HTTP and HTTPS web traffic for TCP only. What should you do?

Options

  • ACreate an allow on match ingress firewall rule with the target tag "web-server" to allow all IP
  • BCreate an allow on match egress firewall rule with the target tag "web-server" to allow all IP
  • CCreate an allow on match ingress firewall rule with the target tag "web-server" to allow all IP
  • DCreate an allow on match egress firewall rule with the target tag "web-server" to allow web server

How the community answered

(44 responses)
  • A
    5% (2)
  • B
    2% (1)
  • C
    84% (37)
  • D
    9% (4)

Why each option

To restrict inbound web server traffic to HTTP and HTTPS, an ingress firewall rule must be configured to allow TCP ports 80 and 443 from all source IP addresses, targeting the web servers.

ACreate an allow on match ingress firewall rule with the target tag "web-server" to allow all IP

This choice is a duplicate of C, hence also correct in principle, but C is the specified answer.

BCreate an allow on match egress firewall rule with the target tag "web-server" to allow all IP

An egress firewall rule controls outbound traffic originating from instances, not inbound traffic destined for them, making it inappropriate for limiting incoming web traffic.

CCreate an allow on match ingress firewall rule with the target tag "web-server" to allow all IPCorrect

Creating an allow on match ingress firewall rule with the target tag 'web-server' to allow all IP address ranges (0.0.0.0/0) on TCP ports 80 (HTTP) and 443 (HTTPS) precisely meets the security requirement. An ingress rule controls incoming traffic to instances, the target tag ensures the rule applies only to the designated web servers, and specifying TCP ports 80 and 443 limits inbound traffic exclusively to standard web protocols.

DCreate an allow on match egress firewall rule with the target tag "web-server" to allow web server

An egress firewall rule controls outbound traffic, not inbound. Furthermore, simply allowing 'web server' as a target without specifying source IP ranges or desired protocols/ports for inbound traffic is insufficient for the stated security goal.

Concept tested: Ingress firewall rules for web traffic

Source: https://cloud.google.com/vpc/docs/firewalls#ingress_and_egress_rules

Topics

#Firewall Rules#VPC Network#Network Security#Ingress Traffic

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice