Examkin

Soru

Zorluk: ZorDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud engineer is deploying a enterprise database tier on Compute Engine instances tagged with `db-node` inside a custom Virtual Private Cloud (VPC) network. To enforce strict security compliance, a firewall rule named `deny-db-all` has been configured with priority 1000 to DENY all ingress TCP traffic on port 5432 targeting the `db-node` tag from `0.0.0.0/0`. The engineer now needs to allow ingress traffic on port 5432 to these database instances specifically from application servers located in the subnet CIDR range `10.2.0.0/24`. Which firewall rule configuration must the engineer implement to ensure application traffic is allowed while maintaining the default restriction for all other sources?

  1. Create an ingress firewall rule named `allow-db-internal` with action ALLOW, target tag `db-node`, source IP range `10.2.0.0/24`, protocol/port `tcp:5432`, and priority 900.Cevap
  2. B
    Create an ingress firewall rule named `allow-db-internal` with action ALLOW, target tag `db-node`, source IP range `10.2.0.0/24`, protocol/port `tcp:5432`, and priority 1100.
  3. C
    Create an ingress firewall rule named `allow-db-internal` with action ALLOW, target tag `db-node`, source IP range `10.2.0.0/24`, protocol/port `tcp:5432`, and priority 1000, relying on VPC internal tie-breaking logic that favors ALLOW over DENY.
  4. D
    Assign the IAM role `roles/compute.securityAdmin` to the database service account so that internal VPC subnet communications automatically bypass ingress firewall rule checks.

Cevap

Create an ingress firewall rule named `allow-db-internal` with action ALLOW, target tag `db-node`, source IP range `10.2.0.0/24`, protocol/port `tcp:5432`, and priority 900.
In Google Cloud VPC networking, firewall rules are processed sequentially by priority value, where lower numbers have higher precedence. Because the general rule blocking port 5432 traffic from all sources has a priority of 1000, creating an allow rule for the specific `10.2.0.0/24` CIDR with priority 900 ensures that packets from application instances in that subnet match the allow rule first and bypass the broader deny rule.

Adım Adım Çözüm

1
Analyze GCP firewall rule priority evaluation order.
GCP evaluates firewall rules based on integer priority values ranging from 0 to 65535, where lower numerical values indicate higher precedence.
Rules with smaller priority numbers are processed first. Evaluation stops as soon as a matching rule is found for the network packet.
2
Determine the necessary priority for the specific allow rule relative to the existing deny rule.
Since the existing `deny-db-all` rule has priority 1000, any exception allowing specific IP ranges must have a priority strictly less than 1000 (e.g., 900).
Setting priority 900 guarantees that packets from source `10.2.0.0/24` match the ALLOW rule first and are permitted before reaching the DENY rule at priority 1000.

Anahtar Kavram

VPC Firewall Rule Priority Evaluation Order
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules