Examkin

Question

Difficulty: HardDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

An enterprise security team requires an update to the firewall rule configuration of a custom Virtual Private Cloud (VPC) network named `prod-vpc`. Currently, an existing ingress firewall rule named `allow-web-internal` has a priority of `1000` and allows TCP port `8080` traffic from `10.1.0.0/16` to all instances in the network. The security team needs to immediately block all TCP port `8080` traffic originating specifically from the subnetwork `10.1.50.0/24`, while maintaining allowed access for all other IP addresses within `10.1.0.0/16`. Which firewall rule configuration should the Cloud Engineer implement to meet this requirement?

  1. Create a new ingress firewall rule with action DENY, target port TCP 8080, source filter 10.1.50.0/24, and assign it a priority of 500.Answer
  2. B
    Create a new ingress firewall rule with action DENY, target port TCP 8080, source filter 10.1.50.0/24, and assign it a priority of 1500.
  3. C
    Apply a project-level IAM Deny policy for Compute Network Admin on the subnetwork 10.1.50.0/24 to block network ingress.
  4. D
    Convert the VPC network from custom mode to auto mode and grant the Primitive Owner role to the instance service accounts to enforce network boundaries.

Answer

Create a new ingress firewall rule with action DENY, target port TCP 8080, source filter 10.1.50.0/24, and assign it a priority lower than 1000 (such as 500).
GCP firewall rules evaluate in order of numerical priority from 0 to 65535, where lower numbers take precedence. Creating a DENY rule for 10.1.50.0/24 with priority 500 ensures that matching packets are evaluated and dropped before reaching the broader ALLOW rule configured at priority 1000.

Step-by-Step Solution

1
Analyze existing firewall evaluation precedence.
The existing rule `allow-web-internal` has a priority of 1000 allowing TCP port 8080 from 10.1.0.0/16.
Firewall rules in GCP are processed in order from lowest numerical priority value (highest precedence) to highest numerical priority value.
2
Determine the required action and priority for the new specific restriction.
To override a broader ALLOW rule at priority 1000 for a specific subset range (10.1.50.0/24), a DENY rule must be created with a priority strictly less than 1000 (e.g., 500).
When a packet matches a rule with lower numerical priority value, processing stops and that action (DENY) is immediately enforced.
3
Verify rule parameters.
Action: DENY, Direction: INGRESS, Target port: 8080, Source IPv4 range: 10.1.50.0/24, Priority: 500.
Traffic from 10.1.50.0/24 hits priority 500 first and gets blocked; traffic from other parts of 10.1.0.0/16 misses priority 500 and evaluates against priority 1000 where it is allowed.

Key Concept

GCP VPC Firewall Rule Priority Precedence & Action Evaluation
Estimated Time:2m 0s
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules