Exam Professional Cloud Network Engineer topic 1 question 188 discussion

Actual exam question from Google's Professional Cloud Network Engineer

Question #: 188
Topic #: 1

[All Professional Cloud Network Engineer Questions]

Your company uses Compute Engine instances that are exposed to the public internet. Each compute instance has a single network interface with a single public IP address. You need to block any connection attempt that originates from internet clients with IP addresses that belong to the BGP_ASN_TOBLOCK BGP ASN. What should you do?

A. Create a new Cloud Armor backend security policy, and use the --network-src-asns parameter.
B. Create a new Cloud Armor network edge security policy, and use the --network-src-asns parameter.
C. Create a new Cloud Armor edge security policy, and use the --network-src-asns parameter.
D. Create a new firewall policy ingress rule, and use the --network-src-asns parameter.

Show Suggested Answer

Suggested Answer: B 🗳️

by b0b25 at Feb. 22, 2025, 4:13 a.m.

Comments

Submit Cancel

glb2

1 month, 3 weeks ago

Selected Answer: C

C is correct. Incorrect: A. Backend security policy applies to backend services behind an HTTP(S) load balancer—not directly to instances with public IPs. B. Network edge security policies do not support the --network-src-asns parameter. D. Firewall policies only support IP ranges, not ASN-based filtering. So this option is invalid.

upvoted 1 times

...

n2183712847

3 months, 2 weeks ago

Selected Answer: B

B is correct

upvoted 1 times

...

RKS_2021

5 months, 3 weeks ago

Selected Answer: B

B is correct

upvoted 2 times

...