A DevOps engineer is managing network security for a custom Virtual Private Cloud (VPC) network named `vpc-prod`. An existing ingress firewall rule named `allow-internal-web` with priority 1000 permits TCP traffic on port 8080 from the `10.0.0.0/8` IP range to VM instances tagged `web-frontend`. To address a security compliance finding, the engineer must explicitly block incoming TCP traffic on port 8080 originating from the `10.2.0.0/24` subnet while preserving access for all other subnets within `10.0.0.0/8`. Which `gcloud` command should the engineer execute?
- gcloud compute firewall-rules create block-subnet-web --network=vpc-prod --action=DENY --direction=INGRESS --priority=500 --source-ranges=10.2.0.0/24 --rules=tcp:8080 --target-tags=web-frontendAnswer
- Bgcloud compute firewall-rules create block-subnet-web --network=vpc-prod --action=DENY --direction=INGRESS --priority=2000 --source-ranges=10.2.0.0/24 --rules=tcp:8080 --target-tags=web-frontend
- CApply a project-level IAM Deny policy to the service account associated with subnet 10.2.0.0/24 to override the existing VPC firewall rule.
- DAssign the primitive Viewer role to instances in the 10.2.0.0/24 subnet to restrict network packet transmissions to port 8080.
Answer
Execute the command creating a DENY ingress rule on port 8080 from source range 10.2.0.0/24 targeted at web-frontend with priority 500.
Google Cloud VPC firewall rules are evaluated based on priority order where lower integer values denote higher evaluation precedence. Since the existing ALLOW rule has a priority of 1000, creating a DENY rule with priority 500 ensures that incoming packets from 10.2.0.0/24 matching port 8080 are matched and dropped first before reaching the priority 1000 allow rule.
Step-by-Step Solution
Key Concept
VPC Firewall Priority Evaluation