Examkin

Question

Difficulty: MediumDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

An infrastructure engineer is configuring VPC firewall rules for web workloads running on Compute Engine instances tagged `web-tier`. An existing ingress firewall rule named `allow-web` allows TCP traffic on port 8080 from `0.0.0.0/0` with a priority of 1000. To meet security requirements, incoming traffic on port 8080 from the external subnet `198.51.100.0/24` must be blocked, while continuing to allow port 8080 traffic from all other external IP addresses. Which configuration will successfully achieve this requirement?

  1. Create an ingress deny rule for TCP port 8080 targeting `web-tier` from source IP range `198.51.100.0/24` with a priority of 900.Answer
  2. B
    Create an ingress deny rule for TCP port 8080 targeting `web-tier` from source IP range `198.51.100.0/24` with a priority of 1100.
  3. C
    Create an egress deny rule for TCP port 8080 targeting `web-tier` with destination IP range `198.51.100.0/24` and a priority of 900.
  4. D
    Create an Organization Policy constraint to deny ingress traffic on port 8080 from source IP range `198.51.100.0/24`.

Answer

Create an ingress deny rule for TCP port 8080 targeting `web-tier` from source IP range `198.51.100.0/24` with a priority of 900.
In Google Cloud VPC firewall rule processing, lower numerical priority values take precedence over higher numerical values. To override an existing allow rule at priority 1000 for a specific CIDR block, an explicit ingress deny rule must be assigned a lower numerical priority (such as 900) so that it is evaluated first. Traffic from the specified subnet will match the deny rule, while all other traffic will bypass the deny rule and match the existing allow rule.

Step-by-Step Solution

1
Determine the firewall direction required for incoming client requests.
Identified that incoming connections require an ingress rule.
Traffic originating outside the VPC network and sent to backend instances is ingress traffic.
2
Evaluate rule action and priority order relative to existing rules.
Selected an ingress deny rule with a lower numerical priority value than 1000 (such as 900).
GCP evaluates VPC firewall rules starting at priority 0 up to 65535. Lower numbers represent higher precedence. Placing a deny rule at priority 900 ensures it is evaluated before the priority 1000 allow rule.

Key Concept

VPC Firewall Priority and Evaluation Precedence
Estimated Time:1m 30s
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules