Examkin

Question

Difficulty: HardDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud administrator is managing firewall configurations for a Google Cloud custom VPC network. The network currently has two ingress firewall rules applied to virtual machines with the target network tag `db-server`:

- Rule `rule-allow-internal`: Direction INGRESS, Action ALLOW, IP protocol/port `tcp:5432`, Source IP ranges `10.150.0.0/16`, Priority 800.
- Rule `rule-deny-external`: Direction INGRESS, Action DENY, IP protocol/port `tcp:5432`, Source IP ranges `0.0.0.0/0`, Priority 300.

Database clients operating within the `10.150.0.0/16` subnet report that their connections to port 5432 on the `db-server` instances are failing. How should the administrator modify the firewall rules to allow access from `10.150.0.0/16` while continuing to block all other traffic on port 5432?

  1. Modify `rule-allow-internal` to have a priority of 200 so that its evaluation takes precedence over `rule-deny-external`.Answer
  2. B
    Modify `rule-allow-internal` to have a priority of 1000 so that its higher numerical value overrides `rule-deny-external`.
  3. C
    Assign the IAM role `roles/compute.networkAdmin` to the database client instances so they inherit explicit firewall bypass permissions.
  4. D
    Assign the primitive `Owner` role to the target virtual machines so they ignore project-level deny rules.

Answer

Modify `rule-allow-internal` to have a priority of 200 so that its evaluation takes precedence over `rule-deny-external`.
In Google Cloud Virtual Private Cloud (VPC), firewall rules are evaluated in ascending numerical order of their priority field (from 0 to 65535). The first rule whose attributes (direction, target tags, protocol, port, source/destination) match the packet determines the action taken. Lower priority values take precedence over higher priority values. Because `rule-deny-external` currently has priority 300 and applies to source `0.0.0.0/0`, it matches all incoming packets—including those from `10.150.0.0/16`—before `rule-allow-internal` (priority 800) is evaluated. Changing `rule-allow-internal` to priority 200 gives it higher precedence than priority 300, allowing traffic from `10.150.0.0/16` to pass while still blocking all other external ingress traffic.

Step-by-Step Solution

1
Analyze firewall rule evaluation order in Google Cloud VPC.
GCP evaluates firewall rules sequentially starting from the lowest priority integer (0) up to the highest (65535). Evaluation stops at the first matching rule.
Lower priority numbers represent higher rule precedence.
2
Evaluate the current rule precedence and behavior for traffic originating from `10.150.0.0/16`.
`rule-deny-external` (Priority 300) matches all source IPs (`0.0.0.0/0`), including `10.150.0.0/16`, before `rule-allow-internal` (Priority 800) can be evaluated.
Since 300 is lower than 800, incoming traffic hits the DENY rule first and gets blocked.
3
Determine the required modification to enforce the intended access policy.
Assigning a priority number lower than 300 (such as 200) to `rule-allow-internal` ensures that internal traffic matching `10.150.0.0/16` is allowed before reaching `rule-deny-external`.
Traffic from `10.150.0.0/16` matches the ALLOW rule at Priority 200 and terminates evaluation, while non-matching external traffic falls through to Priority 300 and gets denied.

Key Concept

GCP VPC Firewall Rule Priority Precedence
Estimated Time:2m 0s
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules