Examkin

Question

Difficulty: HardDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

An infrastructure team is configuring ingress firewall rules in a custom-mode Virtual Private Cloud (VPC) network. The web application frontend Compute Engine instances carry the network tag `web-frontend`. The team needs to allow public inbound HTTPS (TCP port 443) traffic to these instances from any IPv4 source (`0.0.0.0/0`), but must strictly block all inbound HTTPS traffic coming from a known malicious subnet (`198.51.100.0/24`), even if those requests target the `web-frontend` instances. Which firewall rule configuration correctly achieves this requirement while adhering to Google Cloud VPC rule evaluation precedence?

  1. Create an ingress DENY rule for TCP port 443 from source CIDR 198.51.100.0/24 with priority 500 targeting web-frontend, and an ingress ALLOW rule for TCP port 443 from source CIDR 0.0.0.0/0 with priority 1000 targeting web-frontend.Answer
  2. B
    Create an ingress DENY rule for TCP port 443 from source CIDR 198.51.100.0/24 with priority 1500 targeting web-frontend, and an ingress ALLOW rule for TCP port 443 from source CIDR 0.0.0.0/0 with priority 1000 targeting web-frontend.
  3. C
    Create an ingress ALLOW rule with priority 1000 targeting web-frontend, and grant the Compute Security Admin role directly on the individual Compute Engine instances to override VPC network rule evaluation for untrusted IPs.
  4. D
    Grant the Owner primitive role to the service account assigned to the web-frontend instances to automatically enable advanced packet filtering against blocked CIDR blocks.

Answer

Create an ingress DENY rule for TCP port 443 from source CIDR 198.51.100.0/24 with priority 500 targeting web-frontend, and an ingress ALLOW rule for TCP port 443 from source CIDR 0.0.0.0/0 with priority 1000 targeting web-frontend.
In Google Cloud Virtual Private Cloud (VPC) firewall rule architecture, rules are processed in order of priority from 0 to 65535, where a lower numerical value indicates higher precedence. When network traffic matches a rule, rule processing terminates. Assigning priority 500 to the DENY rule for source CIDR 198.51.100.0/24 ensures that requests from this restricted block are evaluated and denied before reaching the priority 1000 ALLOW rule for 0.0.0.0/0.

Step-by-Step Solution

1
Understand GCP VPC firewall rule priority evaluation order.
GCP evaluates rules sequentially based on numerical priority from 0 (highest precedence) to 65535 (lowest precedence). Once a matching rule is found for a packet, evaluation stops.
Lower priority numbers take precedence over higher priority numbers.
2
Identify the specific exception traffic that must be blocked.
Inbound HTTPS traffic from `198.51.100.0/24` must be blocked regardless of general allow policies.
Specific deny rules must take higher precedence than general allow rules.
3
Assign numerical priority values ensuring the DENY rule is evaluated before the ALLOW rule.
Setting the DENY rule priority to 500 and the ALLOW rule priority to 1000 ensures packets from `198.51.100.0/24` hit the DENY rule first and are immediately dropped.
500 is less than 1000, so priority 500 is evaluated first.

Key Concept

VPC Firewall Rule Priority Precedence
Estimated Time:2m 0s
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules