An organization is deploying a custom VPC network named `prod-vpc` containing two regional… — Google Cloud Associate Cloud Engineer

An organization is deploying a custom VPC network named `prod-vpc` containing two regional subnets: `subnet-us` ( $10.10.0.0/24$ ) and `subnet-eu` ( $10.20.0.0/24$ ). A Cloud Engineer must restrict SSH access (TCP port 22) so that Compute Engine instances tagged with `admin-workload` in `subnet-us` can only accept SSH connections coming from a management host residing in `subnet-eu` ( $10.20.0.15/32$ ). Additionally, all other inbound SSH traffic to any instance across the VPC must be blocked. The engineer creates Rule 1 with action ALLOW, direction INGRESS, protocol/port `tcp:22`, source IP `10.20.0.15/32`, target tag `admin-workload`, and priority 100. They also create Rule 2 with action DENY, direction INGRESS, protocol/port `tcp:22`, source IP `0.0.0.0/0`, targets specified as all instances in the network, and priority 50. Which outcome will occur when the management host at $10.20.0.15$ attempts an SSH connection to an instance tagged `admin-workload` in `subnet-us`?

The SSH connection will be denied because Rule 2 has a lower priority number (50) than Rule 1 (100), causing the DENY rule to take precedence over the ALLOW rule regardless of IP specificity or target tags.Answer
B
The SSH connection will be allowed because Rule 1 specifies a more specific source IP range (10.20.0.15/32) and target tag (admin-workload) than Rule 2.
C
The SSH connection will be allowed because explicit ALLOW firewall rules override DENY rules when both rules match the incoming packet.
D
The SSH connection will be denied because organizational IAM policy inheritance blocks cross-subnet SSH traffic unless a explicit primitive Owner role is assigned to the subnet.

Answer

The SSH connection will be denied because Rule 2 has a lower priority number (50) than Rule 1 (100), causing the DENY rule to take precedence over the ALLOW rule regardless of IP specificity or target tags.

Google Cloud VPC firewall rule evaluation follows strict priority ordering from 0 to 65535, where lower integer values denote higher precedence. Rule 2 has a priority of 50, which takes precedence over Rule 1's priority of 100. When traffic from 10.20.0.15/32 arrives on TCP port 22, it matches Rule 2's source CIDR of 0.0.0.0/0 and target scope of all instances. Because Rule 2 is evaluated first and specifies DENY, the packet is immediately dropped before Rule 1 can be evaluated.

Step-by-Step Solution

Analyze GCP firewall priority ordering rules.

GCP VPC firewall rules are processed in strict ascending numerical priority order (0 to 65535). A lower priority number indicates higher precedence.

When a packet matches a rule during evaluation, processing stops immediately and that rule's action is applied.

Compare priority numbers between Rule 1 and Rule 2.

Rule 2 has priority 50, whereas Rule 1 has priority 100. Thus, Rule 2 is evaluated first.

Priority 50 is numerically smaller than 100, granting Rule 2 evaluation precedence.

Evaluate the packet against Rule 2 parameters.

The packet originating from 10.20.0.15/32 on port 22 matches Rule 2 (source range 0.0.0.0/0, protocol tcp:22, target: all instances).

Since 10.20.0.15 falls within 0.0.0.0/0 and Rule 2 applies to all network instances, the DENY action is enforced immediately.

Key Concept

GCP VPC Firewall Rule Priority Evaluation Order

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics