Your team creates an ingress firewall rule to allow SSH access from their corporate IP range to a specific bastion host on Compute Engine. Your team wants to make sure that this firewall rule cannot…

Question

Options

• ACreate the firewall rule with a target of a network tag. Centrally manage access to the tag.
• BCreate the firewall rule with a target of a service account. Centrally manage access to the service
• CCreate the firewall rule in a Shared VPC with a target of a network tag.
• DCreate the firewall rule in a Shared VPC with a target of a specific subnet.

• A
  12% (4)
• B
  62% (21)
• C
  6% (2)
• D
  21% (7)

Explanation

A is not correct because the network tag value can be inferred by examining the Firewall Rule or B is correct because access to the Service Account is required to use a firewall rule with a target of a Service Account. C is not correct because the target network tag value can be inferred by examining the Firewall Rule or VM metadata. D is not correct because the target subnet value can be inferred by examining the Firewall Rule https://cloud.google.com/vpc/docs/firewalls#service-accounts-vs-tags

No community discussion yet for this question.