Examkin

Question

Difficulty: HardDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

An organization is configuring Virtual Private Cloud (VPC) firewall rules for a microservice environment hosted on Compute Engine instances. A security engineer needs to block incoming traffic on TCP port 2222 from external IP addresses while ensuring that an internal administrative subnet (10.2.0.0/2410.2.0.0/24) can maintain SSH access to instances tagged with `admin-bastion`.

Currently, the VPC network has two custom firewall rules:
- `rule-block-ssh`: Action `DENY`, Direction `INGRESS`, Priority `1000`, Source `0.0.0.0/0`, Protocol/Port `tcp:22`, Target `All instances in the network`.
- `rule-allow-admin-ssh`: Action `ALLOW`, Direction `INGRESS`, Priority `5000`, Source `10.2.0.0/24`, Protocol/Port `tcp:22`, Target network tag `admin-bastion`.

Administrators report that internal SSH connections from 10.2.0.0/2410.2.0.0/24 to `admin-bastion` instances are currently being blocked. Which modification should the cloud engineer make to resolve this issue while maintaining all security requirements?

  1. Update `rule-allow-admin-ssh` to have a priority number lower than 1000, such as 500.Answer
  2. B
    Update `rule-allow-admin-ssh` to have a priority number higher than 5000, such as 10000.
  3. C
    Assign the primitive Owner role to the admin service account to bypass the VPC firewall deny rule.
  4. D
    Reconfigure `rule-block-ssh` as an egress rule with priority 500 to allow project-level IAM policies to take precedence.

Answer

Update `rule-allow-admin-ssh` to have a priority number lower than 1000, such as 500.
In Google Cloud VPC networks, firewall rules are evaluated strictly by priority integer values ranging from 0 to 65535, where lower numbers have higher precedence. Because `rule-block-ssh` has a priority of 1000 and source `0.0.0.0/0`, all incoming SSH traffic is denied before reaching `rule-allow-admin-ssh` which has priority 5000. Decreasing the priority number of `rule-allow-admin-ssh` to a value lower than 1000 (such as 500) forces GCP to evaluate and grant the specific admin allow rule first.

Step-by-Step Solution

1
Analyze firewall rule priority evaluation order in Google Cloud VPC.
Google Cloud evaluates ingress firewall rules in order of priority from integer value 0 to 65535, stopping at the first rule match. Lower integers indicate higher evaluation precedence.
Understanding priority ordering is necessary to determine which rule takes effect first when traffic matches multiple rules.
2
Evaluate the current rule precedence for traffic originating from source IP 10.2.0.0/2410.2.0.0/24 targeted at port 2222.
The incoming packet matches `rule-block-ssh` at priority 1000 (since 0.0.0.0/00.0.0.0/0 includes 10.2.0.0/2410.2.0.0/24). Because priority 1000 is evaluated before priority 5000, the packet is denied immediately.
The existing allow rule is never reached because the deny rule has a smaller priority number.
3
Determine the required priority modification to allow administrative SSH traffic.
Assigning `rule-allow-admin-ssh` a priority value less than 1000 (such as 500) ensures that traffic from 10.2.0.0/2410.2.0.0/24 matching port 2222 and tag `admin-bastion` is explicitly allowed before hitting the broader deny rule at priority 1000.
Placing the specific allow rule at a higher precedence (lower priority number) than the general deny rule resolves the connectivity block.

Key Concept

VPC Firewall Rule Priority Evaluation Order
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules