Examkin

Question

Difficulty: Very hardManaging Networking Resources

Your organization operates a multi-tier enterprise workload in Google Cloud using a custom Virtual Private Cloud (VPC) named `prod-vpc`. An existing ingress firewall rule named `allow-app-traffic` currently allows inbound TCP traffic on port 8080 from `10.2.0.0/16` to instances tagged `app-server`, evaluated at a priority of 1000. Due to a compliance update, you must modify this rule to meet three operational requirements:
1. Restrict the source IP range to `10.2.15.0/24`.
2. Ensure the firewall rule takes precedence over a newly added conflicting rule evaluated at priority 500.
3. Keep the target tag `app-server` intact while replacing the source range.

Which `gcloud` command should you execute to accomplish this operational requirement cleanly in a single step?

  1. gcloud compute firewall-rules update allow-app-traffic --source-ranges=10.2.15.0/24 --priority=200Answer
  2. B
    gcloud compute firewall-rules update allow-app-traffic --source-ranges=10.2.15.0/24 --priority=800
  3. C
    gcloud compute firewall-rules create allow-app-traffic --source-ranges=10.2.15.0/24 --priority=200 --extend-subnet
  4. D
    gcloud compute firewall-rules update allow-app-traffic --add-source-ranges=10.2.15.0/24 --priority=200

Answer

Execute 'gcloud compute firewall-rules update allow-app-traffic --source-ranges=10.2.15.0/24 --priority=200' to update the source range and assign a lower numeric priority value for higher evaluation precedence.
In Google Cloud VPC firewall rule evaluation, rules are processed in order of priority from lowest integer value to highest integer value. A priority of 200 is evaluated before priority 500, giving it higher precedence. Additionally, using 'gcloud compute firewall-rules update' with '--source-ranges=10.2.15.0/24' replaces the existing CIDR block while leaving unspecified fields like target tags unchanged.

Step-by-Step Solution

1
Analyze GCP firewall priority ordering rules
GCP evaluates firewall rules starting from the lowest numeric priority value (0) up to the highest (65535).
To override a rule evaluated at priority 500, the updated rule must be assigned a priority strictly less than 500, such as 200.
2
Determine the proper gcloud CLI command and flag syntax for updating firewall rules
The command 'gcloud compute firewall-rules update' modifies existing rules in place.
Passing '--source-ranges=10.2.15.0/24' overwrites the previous source range while preserving existing attributes not explicitly modified, such as target tags.
3
Synthesize parameters into a valid gcloud command execution
The final command specifies both '--source-ranges=10.2.15.0/24' and '--priority=200'.
This updates the rule in a single atomic administrative action without syntax errors or creating duplicate rules.

Key Concept

VPC Firewall Rule Priority and Modification Syntax
Rate this question

Topics

Managing Networking Resources

More questions from this topic