An operations team manages a Virtual Private Cloud (VPC) network in Google Cloud. An existing ingress firewall rule named `deny-all-app-ingress` with priority `1000` denies all incoming TCP traffic on port `8080` across all instances in the VPC. The team needs to grant temporary access on TCP port `8080` specifically for management traffic originating from the IP range `10.10.0.0/24`. The administrator creates a new ingress firewall rule named `allow-mgmt-ingress` targeted at the same instances. Which priority configuration must be assigned to `allow-mgmt-ingress` to ensure management traffic is allowed without deleting or modifying `deny-all-app-ingress`?
- A priority number less than 1000 (such as 500)Answer
- BA priority number greater than 1000 (such as 1500)
- CA priority number equal to 1000
- DPriority 65535
Answer
Assign a priority number less than 1000 (such as 500) to the new rule so that it is evaluated prior to the existing priority 1000 deny rule.
In Google Cloud VPC networks, firewall rules are evaluated based on priority numbers ranging from 0 to 65535. Lower numerical values have higher evaluation precedence. Assigning a priority number less than 1000 (such as 500) guarantees that incoming traffic from 10.10.0.0/24 on port 8080 will match the allow rule first and be permitted before reaching the deny rule set at priority 1000.
Step-by-Step Solution
Key Concept
VPC Firewall Rule Precedence and Priority Evaluation
Estimated Time:1m 30s