Examkin

Question

Difficulty: HardDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

An infrastructure engineer needs to restrict outbound network traffic for Compute Engine instances located within a custom Virtual Private Cloud (VPC) subnet. The engineer creates a custom egress firewall rule that denies all egress traffic to destination 0.0.0.0/00.0.0.0/0 with a priority of 10001000. A specific set of virtual machines tagged with `api-client` requires HTTPS access to an external partner service hosted at IP address 198.51.100.25/32198.51.100.25/32. How should the engineer configure the firewall rules to allow this specific outbound connection while maintaining the blanket block?

  1. Create an egress firewall rule with priority 900, target tag `api-client`, action ALLOW, destination CIDR range `198.51.100.25/32`, and protocol/port `tcp:443`.Answer
  2. B
    Create an egress firewall rule with priority 1100, target tag `api-client`, action ALLOW, destination CIDR range `198.51.100.25/32`, and protocol/port `tcp:443`.
  3. C
    Create an ingress firewall rule with priority 900, target tag `api-client`, action ALLOW, source CIDR range `198.51.100.25/32`, and protocol/port `tcp:443`.
  4. D
    Assign the Compute Network Admin IAM role to the service account attached to the `api-client` instances to allow them to override VPC network firewall restrictions.

Answer

Create an egress firewall rule with priority 900, target tag `api-client`, action ALLOW, destination CIDR range `198.51.100.25/32`, and protocol/port `tcp:443`.
Google Cloud Virtual Private Cloud (VPC) firewall rules are evaluated based on rule priority, where lower numerical values indicate higher precedence. When creating a specific exception to a broad deny rule (such as a blanket egress block at priority 1000), the allowed rule must have a priority number lower than 1000 (such as 900) so that it is processed first. Furthermore, because the virtual machine initiates outbound traffic to an external endpoint, an egress firewall rule targeting the destination IP address and port is required.

Step-by-Step Solution

1
Determine the direction of network traffic.
Traffic originates inside the VPC from internal Compute Engine instances toward an external endpoint (198.51.100.25/32198.51.100.25/32), requiring an egress firewall rule.
Connection attempts initiated by VM instances outward must match egress firewall rules.
2
Analyze VPC firewall priority resolution rules.
Lower priority numerical values represent higher evaluation precedence (00 is highest priority, 6553565535 is lowest priority).
The specific ALLOW exception rule must evaluate before the broader DENY rule configured at priority 10001000.
3
Specify a priority value lower than 1000 for the ALLOW rule.
Configuring priority 900900 ensures that matching outbound HTTPS packets for instances tagged `api-client` are allowed and evaluation terminates before reaching priority 10001000.
Traffic matching priority 900900 is granted egress access immediately.

Key Concept

GCP VPC Firewall Priority and Egress Traffic Direction
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules