Answer-first summary for fast verification
Answer: Create Cloud Armor Security Policy with the source ip ranges.
The correct answer is A: Create Cloud Armor Security Policy with the source IP ranges. Here’s why: The requirement is to allow only traffic from Fastly’s IP address ranges to reach the External HTTP(S) Load Balancer. Firewall rules (options C and D) will not work for this because firewall rules in Google Cloud apply to backend instances, not to the load balancer’s frontend. To filter traffic before it reaches the backend, you must use Google Cloud Armor. Cloud Armor can filter traffic based on either manually specified source IP ranges or Google’s preconfigured IP lists. Preconfigured IP lists are maintained by Google for certain well-known services (like Googlebot or Office 365). However, Fastly is not one of the preconfigured IP lists in Cloud Armor. This means you cannot simply reference a “sourceiplist-fastly” in a rule (which is what option B implies). Instead, you must manually enter Fastly’s published IP ranges into the Cloud Armor security policy. Therefore, the correct approach is to create a Cloud Armor security policy and add a rule that allows only the Fastly IP ranges, and then attach that policy to the load balancer’s backend service. This ensures that only requests from Fastly’s IP ranges are allowed through, and all other traffic is denied. Final answer: A.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
The Helicopter Racing League (HRL) is expanding its operations and has recently started a new regional racing league in Cape Town, South Africa. To improve the user experience for customers in Cape Town, HRL has partnered with the Content Delivery Network (CDN) provider, Fastly. HRL needs to configure their Virtual Private Cloud (VPC) network to allow traffic coming from all of the Fastly IP address ranges. As a member of the HRL security team, you need to update the settings to ensure only the Fastly IP address ranges are allowed through the External HTTP(S) load balancer. Which command should you use?
A
Create Cloud Armor Security Policy with the source ip ranges.
B
Create Cloud Armor Security Policy with the source ip list.
C
Create firewall rule to allow source ip list.
D
Create firewall rule to allow source ip range.
No comments yet.