PCNE Implementing network security — All Questions With Answers

{
  "bindings": [
    {
      "role": "roles/compute.securityAdmin",
      "members": [
        "user:alice@example.com"
      ]
    },
    {
      "role": "roles/compute.networkAdmin",
      "members": [
        "user:bob@example.com"
      ]
    }
  ]
}

{
  "rules": [
    {
      "action": "deny(403)",
      "priority": 1000,
      "match": {
        "versionedExpr": "SRC_IPS_V1",
        "config": {
          "srcIpRanges": ["10.0.0.0/8"]
        }
      }
    },
    {
      "action": "allow",
      "priority": 2000,
      "match": {
        "versionedExpr": "SRC_IPS_V1",
        "config": {
          "srcIpRanges": ["0.0.0.0/0"]
        }
      }
    }
  ]
}

gcloud compute instances describe instance-1 --format="yaml(tags, serviceAccounts)"
tags:
  items:
  - web
serviceAccounts:
- email: test@project.iam.gserviceaccount.com
  scopes:
  - https://www.googleapis.com/auth/cloud-platform

---

Firewall rule:
gcloud compute firewall-rules describe allow-ssh-iap
allowed:
- IPProtocol: tcp
  ports:
  - '22'
direction: INGRESS
priority: 1000
sourceRanges:
- 35.235.240.0/20
targetTags:
- ssh-iap

gcloud compute firewall-rules list --format="table(name, network, direction, priority, sourceRanges, allowed, denied)"
NAME           NETWORK  DIRECTION  PRIORITY  SOURCE_RANGES    ALLOWED          DENIED
allow-http     default  INGRESS    1000      0.0.0.0/0        tcp:80
deny-ssh       default  INGRESS    100       10.0.1.0/24      tcp:22
default-allow-ssh default INGRESS 65535     0.0.0.0/0        tcp:22
allow-internal default  INGRESS    65535     10.0.0.0/8       all

Cloud Armor security policy 'my-policy' with rules:
- priority: 100, match: request headers: User-Agent: *BadBot*, action: deny(403)
- priority: 200, match: request headers: User-Agent: *GoodBot*, action: allow
- priority: 300, match: request path: /admin, action: deny(403)
- priority: 1000, default rule: allow

{
  "name": "my-perimeter",
  "status": {
    "accessLevels": [
      "accessPolicies/12345/accessLevels/trusted_ips"
    ],
    "resources": ["projects/111111111111"],
    "restrictedServices": ["bigquery.googleapis.com"],
    "vpcAccessibleServices": {
      "allowedServices": ["bigquery.googleapis.com"],
      "enableRestriction": true
    }
  }
}