Exam Professional Cloud Architect topic 3 question 2 discussion

Got this question in my exam, answered D

Is D: In the GCP doc can see the same example https://cloud.google.com/armor/docs/configure-security-policies#gcloud_11 "gcloud compute security-policies rules create 1000 \ --security-policy my-policy \ --expression "evaluatePreconfiguredExpr('sourceiplist-fastly')" \ --action "allow" "

Suggested Answer A is incorrect, answer is D. AWS firewalls can be used to restrict both internal and external traffic. GCP firewall rules are werid where VPC level firewall rules are for restricting internal traffic & cloud armor which gets attached to LB's is used to restrict external traffic. So due to GCP oddity: 'gcloud compute firewall' refers to internal VPC firewall config which isn't relevant, while 'gcloud compute security-policies' refers to Cloud Armor, which gets attached to LBs and is used to configure external firewall rules, which is relevant. Once you understand that D as the answer starts to make intuitive sense.

It's D

The correct answer is D. The syntax for command must include --Security-policy, --expression or --src-in-ranges ( for option A IP range is wild card) hence correct answer is D.

The most appropriate command for allowing traffic from all Fastly IP address ranges into the HRL Virtual Private Cloud (VPC) network through the External HTTP(S) load balancer would be: A. Create Cloud Armor Security Policy with the source IP ranges. Explanation: Cloud Armor is the tool designed specifically for protecting HTTP(S) load balancers and controlling access based on IP address ranges. It allows you to create security policies to allow or deny traffic from specific IP ranges, which is what you need to do for Fastly IPs. This approach is specifically designed for managing traffic to HTTP(S) load balancers, providing an additional layer of security that fits this scenario perfectly.

(D), or "Create Cloud Armor Security Policy with the source ip list" (considering @hashi's comment) looks correct. https://codelabs.developers.google.com/codelabs/cloud-cloudarmor#0

Totally agree with D

I got this question in March 2024. As someone pointed out answers are reworked. Instead of asking for the command, the choices were given in wordings - something like the below. (Not the exact words) A. Create Cloud Armor Security Policy with the source ip ranges. B. Create Cloud Armor Security Policy with the source ip list C. Create firewall rule to allow source ip list D. Create firewall rule to allow source ip range Based on the answers for this question I went with "Create Cloud Armor Security Policy with the source ip list"

D is right

should be D

D is the solution

D d d d

D is the ans

I guess D

D -> https://cloud.google.com/armor/docs/configure-security-policies#create-rules

D for sure