Examkin

Question

Difficulty: MediumDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A security operations team is reviewing firewall rules configured for a custom-mode Virtual Private Cloud (VPC) network. Two ingress firewall rules target Compute Engine instances carrying the tag `analytics-worker`:

- Rule 1: Action: DENY | Priority: 900 | Source CIDR: `10.10.0.0/16` | Protocol/Port: `tcp:80`
- Rule 2: Action: ALLOW | Priority: 1100 | Source CIDR: `10.10.1.0/24` | Protocol/Port: `tcp:80`

An internal client with IP address `10.10.1.50` sends an HTTP request on port 80 to a VM tagged `analytics-worker`. Which behavior will Google Cloud exhibit for this network request?

  1. The request is denied because Rule 1 has a lower priority number (900), giving it higher precedence over Rule 2.Answer
  2. B
    The request is allowed because Rule 2 specifies a higher priority number (1100), which overrides rules with lower numerical values.
  3. C
    The request is allowed because Rule 2 specifies a more specific CIDR subnet mask (/24), which automatically takes precedence over broader network ranges.
  4. D
    The request is denied because DENY actions always take precedence over ALLOW actions regardless of the priority assigned to the firewall rules.

Answer

The request is denied because Rule 1 has a lower priority number (900), giving it higher precedence over Rule 2 (1100).
In Google Cloud VPC networking, firewall rules are evaluated strictly by their priority integer (ranging from 0 to 65535). Lower numerical values signify higher precedence. Because Rule 1 is assigned priority 900 and Rule 2 is assigned priority 1100, Rule 1 is evaluated first and denies the incoming HTTP request.

Step-by-Step Solution

1
Identify matching rules
Both Rule 1 (DENY) and Rule 2 (ALLOW) match the target tag (`analytics-worker`), protocol/port (`tcp:80`), and source IP (`10.10.1.50` falls into both `10.10.0.0/16` and `10.10.1.0/24`).
Before comparing priorities, verify which rules apply to the specific packet.
2
Compare firewall rule priorities
Rule 1 has priority 900, while Rule 2 has priority 1100.
GCP evaluates firewall rules strictly by priority order.
3
Determine rule precedence
Rule 1 (priority 900) takes precedence because lower numerical integers represent higher priority in GCP.
Lower priority values are evaluated first and terminate further rule matching once a match occurs.

Key Concept

GCP Firewall Priority Order Evaluation
Estimated Time:1m 30s
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules