Examkin

Soru

Zorluk: Çok zorDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

An organization is deploying a custom VPC network named `prod-vpc` containing two regional subnets: `subnet-us` (10.10.0.0/2410.10.0.0/24) and `subnet-eu` (10.20.0.0/2410.20.0.0/24). A Cloud Engineer must restrict SSH access (TCP port 22) so that Compute Engine instances tagged with `admin-workload` in `subnet-us` can only accept SSH connections coming from a management host residing in `subnet-eu` (10.20.0.15/3210.20.0.15/32). Additionally, all other inbound SSH traffic to any instance across the VPC must be blocked. The engineer creates Rule 1 with action ALLOW, direction INGRESS, protocol/port `tcp:22`, source IP `10.20.0.15/32`, target tag `admin-workload`, and priority 100. They also create Rule 2 with action DENY, direction INGRESS, protocol/port `tcp:22`, source IP `0.0.0.0/0`, targets specified as all instances in the network, and priority 50. Which outcome will occur when the management host at 10.20.0.1510.20.0.15 attempts an SSH connection to an instance tagged `admin-workload` in `subnet-us`?

  1. The SSH connection will be denied because Rule 2 has a lower priority number (50) than Rule 1 (100), causing the DENY rule to take precedence over the ALLOW rule regardless of IP specificity or target tags.Cevap
  2. B
    The SSH connection will be allowed because Rule 1 specifies a more specific source IP range (10.20.0.15/32) and target tag (admin-workload) than Rule 2.
  3. C
    The SSH connection will be allowed because explicit ALLOW firewall rules override DENY rules when both rules match the incoming packet.
  4. D
    The SSH connection will be denied because organizational IAM policy inheritance blocks cross-subnet SSH traffic unless a explicit primitive Owner role is assigned to the subnet.

Cevap

The SSH connection will be denied because Rule 2 has a lower priority number (50) than Rule 1 (100), causing the DENY rule to take precedence over the ALLOW rule regardless of IP specificity or target tags.
Google Cloud VPC firewall rule evaluation follows strict priority ordering from 0 to 65535, where lower integer values denote higher precedence. Rule 2 has a priority of 50, which takes precedence over Rule 1's priority of 100. When traffic from 10.20.0.15/32 arrives on TCP port 22, it matches Rule 2's source CIDR of 0.0.0.0/0 and target scope of all instances. Because Rule 2 is evaluated first and specifies DENY, the packet is immediately dropped before Rule 1 can be evaluated.

Adım Adım Çözüm

1
Analyze GCP firewall priority ordering rules.
GCP VPC firewall rules are processed in strict ascending numerical priority order (0 to 65535). A lower priority number indicates higher precedence.
When a packet matches a rule during evaluation, processing stops immediately and that rule's action is applied.
2
Compare priority numbers between Rule 1 and Rule 2.
Rule 2 has priority 50, whereas Rule 1 has priority 100. Thus, Rule 2 is evaluated first.
Priority 50 is numerically smaller than 100, granting Rule 2 evaluation precedence.
3
Evaluate the packet against Rule 2 parameters.
The packet originating from 10.20.0.15/32 on port 22 matches Rule 2 (source range 0.0.0.0/0, protocol tcp:22, target: all instances).
Since 10.20.0.15 falls within 0.0.0.0/0 and Rule 2 applies to all network instances, the DENY action is enforced immediately.

Anahtar Kavram

GCP VPC Firewall Rule Priority Evaluation Order
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules