Examkin

Question

Difficulty: MediumDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud solution architect is configuring ingress firewall rules for a Google Cloud Virtual Private Cloud (VPC) network. An existing firewall rule allows SSH traffic (TCP port 22) from any source IP range (0.0.0.0/0) with a rule priority of 1000. The security team issues a new requirement to restrict SSH access so that only connections from the administrative CIDR range 192.168.10.0/24 are permitted, while all other SSH traffic from 0.0.0.0/0 must be blocked. Which firewall rule configuration correctly meets this requirement?

  1. Create a DENY rule for TCP port 22 from source 0.0.0.0/0 with priority 1000, and create an ALLOW rule for TCP port 22 from source 192.168.10.0/24 with priority 500.Answer
  2. B
    Create a DENY rule for TCP port 22 from source 0.0.0.0/0 with priority 500, and create an ALLOW rule for TCP port 22 from source 192.168.10.0/24 with priority 1000.
  3. C
    Attach a conditional IAM policy at the VPC subnet level to revoke network viewer access from unauthorized external IP addresses.
  4. D
    Assign the primitive Owner role to the administrative subnet while removing all default egress routes for port 22.

Answer

Create a DENY rule for TCP port 22 from source 0.0.0.0/0 with priority 1000, and create an ALLOW rule for TCP port 22 from source 192.168.10.0/24 with priority 500.
In Google Cloud VPC networking, firewall rules are evaluated based on priority numbers ranging from 0 to 65535, where lower numbers have higher precedence. To allow traffic from a specific subnet (192.168.10.0/24) while blocking all other sources (0.0.0.0/0), the ALLOW rule must have a lower priority number (e.g., 500) than the DENY rule (e.g., 1000). Incoming SSH packets from 192.168.10.0/24 match the priority 500 ALLOW rule first and are accepted. All other incoming packets bypass the first rule and hit the priority 1000 DENY rule.

Step-by-Step Solution

1
Understand GCP VPC firewall rule priority evaluation order.
GCP evaluates firewall rules sequentially starting from the lowest integer value (0) up to the highest integer value (65535).
Lower priority numbers represent higher evaluation precedence.
2
Determine the required precedence for specific allow vs general deny rules.
The specific rule allowing 192.168.10.0/24 must be evaluated before the broad rule blocking 0.0.0.0/0.
If the general DENY rule were evaluated first, all traffic (including administrative traffic) would be matched and dropped immediately.
3
Assign numerical priority values based on precedence order.
Assign priority 500 to the ALLOW rule for 192.168.10.0/24 and priority 1000 to the DENY rule for 0.0.0.0/0.
Priority 500 ensures administrative traffic is allowed first, while all remaining SSH traffic hits the priority 1000 DENY rule.

Key Concept

VPC Firewall Rule Priority Precedence
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules