Examkin

Soru

Zorluk: OrtaDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A system administrator configures two custom ingress firewall rules on a VPC network named `production-vpc` to manage access to a group of internal web servers tagged `web-server`:

1. Rule `allow-internal-web`: Priority 1000, Action: Allow, Target tags: `web-server`, Source tags: `internal-client`, Protocols/ports: `tcp:8080`
2. Rule `deny-web-all`: Priority 800, Action: Deny, Target tags: `web-server`, Source IP ranges: `0.0.0.0/0`, Protocols/ports: `tcp:8080`

During testing, instances tagged `internal-client` are unable to reach instances tagged `web-server` on port 8080. Which configuration change will allow traffic from `internal-client` to `web-server` on TCP port 8080 while continuing to block all other ingress traffic?

  1. Change the priority of the rule `allow-internal-web` to a value lower than 800, such as 700.Cevap
  2. B
    Change the priority of the rule `allow-internal-web` to a value higher than 800, such as 1200.
  3. C
    Assign the primitive `Owner` IAM role to the service account used by the web server Virtual Machines.
  4. D
    Delete the `deny-web-all` firewall rule and rely on GCP Organization Policy inheritance to restrict incoming public traffic.

Cevap

Change the priority of the rule allow-internal-web to a numerical value lower than 800 (for example, priority 700).
Google Cloud VPC firewall rules are processed strictly by priority order, where lower numbers have higher precedence. Currently, the deny rule (priority 800) takes precedence over the allow rule (priority 1000), blocking all traffic on TCP port 8080 including traffic from `internal-client`. Changing the priority of `allow-internal-web` to a value lower than 800 (such as 700) ensures that packets from `internal-client` match the allow rule first and are permitted, while non-matching traffic falls through to priority 800 and is denied.

Adım Adım Çözüm

1
Analyze firewall rule evaluation order in Google Cloud VPC.
Google Cloud evaluates firewall rules by priority, where lower numerical values represent higher precedence (0 is highest priority, 65535 is lowest).
Understanding priority ordering determines which rule takes action when multiple rules match incoming traffic.
2
Compare current priorities of conflicting rules.
The `deny-web-all` rule has priority 800 and matches all source IPs (`0.0.0.0/0`), so it matches `internal-client` traffic first and denies it before `allow-internal-web` (priority 1000) is evaluated.
Rule matching stops at the first rule encountered in order of precedence.
3
Adjust priority so the specific allow rule takes precedence over the general deny rule.
Lowering the priority number of `allow-internal-web` below 800 (e.g., to 700) ensures legitimate internal client traffic matches the allow rule first.
Traffic from internal-client will hit the priority 700 rule and be allowed, while all other traffic will fall through to priority 800 and be denied.

Anahtar Kavram

VPC Firewall Rule Priority and Evaluation Precedence
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules