A network operations team is deploying firewall rules in a custom-mode Virtual Private Cloud (VPC) network. A target compute tier tagged `db-node` must receive PostgreSQL traffic on TCP port 5432 exclusively from an application tier tagged `app-node`. An existing firewall rule named `block-db-ingress` explicitly denies all ingress traffic on port 5432 with a priority of 500. Which TWO configuration settings must be applied to the new firewall rule to successfully allow this ingress traffic?
- Set the rule priority to a numerical value lower than 500 (such as 100).Cevap
- Configure the target tags as `db-node` and the source tags as `app-node`.Cevap
- CSet the rule priority to a numerical value higher than 500 (such as 1000).
- DGrant the primitive Editor role to the service account assigned to the destination instances to bypass VPC firewall rules.
Cevap
The correct options require setting the firewall rule priority to a numerical value lower than 500 and configuring target tags as `db-node` with source tags as `app-node`.
To grant access when a broader deny rule exists, the new allow rule must have a lower numerical priority (e.g., 100) than the existing deny rule (priority 500) because GCP processes rules in ascending numerical order. Additionally, for ingress rules, target tags identify the receiving destination workloads while source tags specify allowed origin workloads.
Adım Adım Çözüm
Anahtar Kavram
VPC Firewall Priority and Network Tag Evaluation
Tahmini Süre:1m 30s