A DevOps engineer needs to create an ingress firewall rule in a Virtual Private Cloud (VPC) network named `production-vpc` to allow HTTPS traffic (TCP port 443) to Compute Engine virtual machines tagged as `secure-app`. An existing firewall rule with a priority of 1000 currently denies all ingress traffic to instances with the `secure-app` tag. The new rule must take precedence over the existing deny rule to allow HTTPS traffic. Which `gcloud` command should the engineer run?
- `gcloud compute firewall-rules create allow-https-secure --network=production-vpc --action=ALLOW --direction=INGRESS --rules=tcp:443 --target-tags=secure-app --priority=500`Cevap
- B`gcloud compute firewall-rules create allow-https-secure --network=production-vpc --action=ALLOW --direction=INGRESS --rules=tcp:443 --target-tags=secure-app --priority=2000`
- C`gcloud compute firewall-rules create allow-https-secure --network=production-vpc --action=ALLOW --direction=INGRESS --rules=tcp:443 --target-tags=secure-app --priority=1000`
- D`gcloud compute firewall-rules update default-deny --network=production-vpc --allow=tcp:443 --target-tags=secure-app --priority=1`
Cevap
The command specifying `--priority=500` is correct because Google Cloud VPC firewall rules process lower priority numbers before higher numbers, allowing priority 500 to override the existing priority 1000 deny rule.
In Google Cloud Platform, firewall rules are processed sequentially based on priority numbers, where a lower numerical value indicates higher priority (higher precedence). A rule with priority 500 is evaluated before a rule with priority 1000. When traffic matches the allow rule at priority 500, processing stops, effectively overriding the deny rule at priority 1000.
Adım Adım Çözüm
Anahtar Kavram
GCP Firewall Priority Ordering and Rule Precedence