Examkin

Question

Difficulty: EasyDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

An administrator is configuring ingress firewall rules for a Virtual Private Cloud (VPC) network in Google Cloud. Rule-Alpha is configured with a priority of 200 and an action of DENY. Rule-Beta is configured with a priority of 800 and an action of ALLOW. Both rules target the exact same Compute Engine instances and match the exact same protocol and port. Which rule takes precedence when matching traffic arrives?

  1. Rule-Alpha takes precedence because in Google Cloud VPC networks, lower numerical priority values denote higher precedence.Answer
  2. B
    Rule-Beta takes precedence because higher numerical priority values override lower priority values in Google Cloud VPC networks.
  3. C
    Rule-Beta takes precedence because ALLOW rules automatically override DENY rules regardless of priority integer values.
  4. D
    Both rules are evaluated simultaneously, and traffic is allowed by default if any matching ALLOW rule exists.

Answer

Rule-Alpha takes precedence because in Google Cloud VPC networks, lower numerical priority values denote higher precedence.
In Google Cloud VPC firewall rule evaluation, priority is specified as an integer from 0 to 65535. Lower numerical values represent higher relative priority. Because Rule-Alpha has a priority of 200 and Rule-Beta has a priority of 800, Rule-Alpha is evaluated first and its DENY action is enforced.

Step-by-Step Solution

1
Identify the priority integers assigned to both firewall rules matching the traffic.
Rule-Alpha has priority 200; Rule-Beta has priority 800.
Firewall precedence in GCP is governed by numerical priority values.
2
Apply Google Cloud VPC firewall rule evaluation ordering rules.
Lower numerical integers indicate higher relative priority (0 is the highest possible priority).
Rule-Alpha (200) is evaluated before Rule-Beta (800).
3
Determine the outcome for incoming matching network traffic.
Rule-Alpha matches first and enforces its DENY action.
Evaluation stops at the first matching rule in priority order.

Key Concept

GCP VPC Firewall Rule Priority Precedence
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules