Exam Professional Cloud Network Engineer topic 1 question 121 discussion

C and D is wrong, source address can be subnet-b (172.16.0.0/24) A is wrong, syntax error. B is correct, https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create

Option B is the best option. It leverages service accounts for more granular access control and avoids potential issues with network tag misconfigurations. While Option A is incorrect, and Option D has issues with source IP, Option B combines a secure and appropriate method for defining access control to your database servers.

Hi, Even though option A has a Typo error, I think it is the best choice since we can't create a firewall policy with Source-service-account.

I don't understand this question. A) Doesn't work as you can't mix tags + service accounts on a firewall rule. B) Doesn't work as the SA indicated as source in the gcloud command doesn't exist: source-service-accounts [email protected] + TCP:3306 doesn't work, it must be with minus tcp:3306. C) Doesn't work as source-ranges should be 172.16.0.0/24 and NOT 10.128.0.0/20 + TCP:3306 doesn't work, it must be with minus tcp:3306. D) Doesn't work as source-ranges should be 172.16.0.0/24 and NOT 10.128.0.0/20. So, if I had to choose one, I would choose B), but it's not properly written.

• B. Create service accounts [email protected] and [email protected]. Associate service account sa-app with the application servers, and associate the service account sa-db with the database servers. Run the following command: gcloud compute firewall-rules create app-db-firewall-ru --allow TCP:3306 \ --source-service-accounts sa-app@democloud-idp- demo.iam.gserviceaccount.com \ --target-service-accounts sa-db@my- project.iam.gserviceaccount.com

B is the only choice. Service Accounts and Tags are mutually exclusive and can't be combined in the same firewall rule. You cannot specify both service accounts and tags in the same rule. https://cloud.google.com/vpc/docs/using-firewalls#gcloud_5

B is correct. Looks like you can't combine tags and service account See https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create. --source-service-accounts=EMAIL,[EMAIL,…] The email of a service account indicating the set of instances on the network which match a traffic source in the firewall rule. If a source service account is specified then neither source tags nor target tags can also be specified.

B is the correct, source address can only be subnet-b (172.16.0.0/24) and A is wrong because you can't have source tags and destination SA's.

D is correct!