Examkin

Question

Difficulty: MediumDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A system administrator needs to restrict outbound network connections from Compute Engine instances with the network tag `database-node` in a custom Virtual Private Cloud (VPC) named `production-vpc`. The requirement specifies blocking all egress traffic originating from these instances to a legacy external IP address `198.51.100.50/32`, while taking precedence over standard default rules. Which `gcloud` command correctly implements this security requirement?

  1. gcloud compute firewall-rules create deny-db-outbound --network=production-vpc --direction=EGRESS --action=DENY --rules=all --destination-ranges=198.51.100.50/32 --target-tags=database-node --priority=500Answer
  2. B
    gcloud compute firewall-rules create deny-db-outbound --network=production-vpc --direction=EGRESS --action=DENY --rules=all --destination-ranges=198.51.100.50/32 --target-tags=database-node --priority=65534
  3. C
    gcloud compute firewall-rules create deny-db-outbound --network=production-vpc --direction=INGRESS --action=DENY --rules=all --source-ranges=198.51.100.50/32 --target-tags=database-node --priority=500
  4. D
    gcloud compute firewall-rules create deny-db-outbound --network=production-vpc --direction=EGRESS --action=DENY --rules=all --source-ranges=198.51.100.50/32 --target-tags=database-node --priority=500

Answer

The correct command executes `gcloud compute firewall-rules create deny-db-outbound --network=production-vpc --direction=EGRESS --action=DENY --rules=all --destination-ranges=198.51.100.50/32 --target-tags=database-node --priority=500`.
The correct command uses `--direction=EGRESS` with `--destination-ranges=198.51.100.50/32` to block outbound connections from instances matching `--target-tags=database-node`. Choosing `--priority=500` ensures this custom rule takes precedence over default rules because GCP evaluates lower priority numbers first.

Step-by-Step Solution

1
Identify traffic direction and destination parameters
Since traffic originates from VM instances bound for an external target IP address, the firewall rule must be configured for EGRESS direction using `--destination-ranges`.
Egress rules filter outbound packets leaving Compute Engine instances toward specified target destination IP ranges.
2
Select target instances and rule action
Use `--target-tags=database-node` to scope the rule specifically to database VMs, and `--action=DENY` with `--rules=all` to block all protocol traffic.
Target tags constrain firewall rule evaluation strictly to Compute Engine instances with matching tags.
3
Evaluate rule priority requirements
Assign a priority number such as 500 (lower integers represent higher priority in Google Cloud VPC firewall evaluation).
Lower numerical priority values take precedence over higher numbers (such as default egress allow rules evaluated at priority 65535).

Key Concept

GCP VPC Egress Firewall Rules and Priority Precedence
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules