Examkin

Question

Difficulty: HardDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

An organization operates a custom-mode Virtual Private Cloud (VPC) named `production-vpc`. To adhere to security compliance, an ingress firewall rule named `deny-ssh-global` was created with a priority of `1000` to deny TCP port 22 traffic from source `0.0.0.0/0` across all instances in the VPC. The operations team now requires temporary SSH access to a specific subset of Compute Engine instances tagged with `ops-troubleshoot` from an internal management IP range of `10.50.0.0/20`. How should you configure the new firewall rule to allow this access while leaving the global restriction intact for all other instances?

  1. Create an ingress firewall rule allowing TCP port 22 from source IP range 10.50.0.0/20 with target tag ops-troubleshoot and assign a priority of 500.Answer
  2. B
    Create an ingress firewall rule allowing TCP port 22 from source IP range 10.50.0.0/20 with target tag ops-troubleshoot and assign a priority of 2000.
  3. C
    Apply a Deny IAM policy at the folder level to block project-level network permissions for unauthorized users.
  4. D
    Grant the primitive Editor role to the service account assigned to the ops-troubleshoot instances.

Answer

Create an ingress firewall rule allowing TCP port 22 from source IP range 10.50.0.0/20 with target tag ops-troubleshoot and assign a priority of 500.
In Google Cloud VPC networks, firewall rules are processed according to numerical priority order, where lower integer values denote higher evaluation precedence (priority 0 is evaluated first). Creating an ingress ALLOW rule with a priority of 500 ensures that incoming packets matching the target tag ops-troubleshoot and source range 10.50.0.0/20 are evaluated and permitted before reaching the broad DENY rule configured at priority 1000.

Step-by-Step Solution

1
Analyze GCP firewall rule evaluation order.
GCP evaluates firewall rules based on numerical priority from 0 to 65535, where lower numbers have higher precedence.
To override an existing DENY rule with priority 1000, the ALLOW rule must have a priority lower than 1000 (e.g., 0 through 999).
2
Determine target scope and parameters.
Filter traffic by source range 10.50.0.0/20, protocol/port TCP:22, and target network tag ops-troubleshoot.
Using target network tags limits the scope of the exception rule specifically to the designated management instances without exposing other instances in the VPC.
3
Select the correct priority value.
Setting priority to 500 ensures incoming SSH traffic matching the target tag and source range is evaluated and allowed prior to hitting the global deny rule at priority 1000.
Rule evaluation stops at the first matching rule.

Key Concept

GCP VPC Firewall Rule Priority Precedence
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules