Examkin

Soru

Zorluk: Çok zorDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud engineer is securing a custom-mode Virtual Private Cloud (VPC) named `sec-corp-vpc` hosting PCI-DSS compliant workloads across multiple regions. The compliance baseline requires that all outbound (egress) network traffic from instances to internet destinations (0.0.0.0/00.0.0.0/0) must be blocked by default. However, Compute Engine virtual machines designated with the service account `[email protected]` must be allowed to make outbound HTTPS requests (TCP port 443) to external payment gateways. Assuming only the implicit VPC firewall rules currently exist, which configuration of `gcloud compute firewall-rules create` commands correctly enforces this security policy?

  1. Create an egress DENY rule for protocol `all` to destination `0.0.0.0/0` with priority 200 targeting all instances, and create an egress ALLOW rule for protocol `tcp:443` to destination `0.0.0.0/0` with priority 100 specifying `--target-service-accounts=payment-processor@prod-project.iam.gserviceaccount.com`.Cevap
  2. B
    Create an egress DENY rule for protocol `all` to destination `0.0.0.0/0` with priority 100 targeting all instances, and create an egress ALLOW rule for protocol `tcp:443` to destination `0.0.0.0/0` with priority 200 specifying `--target-service-accounts=payment-processor@prod-project.iam.gserviceaccount.com`.
  3. C
    Create an ingress DENY rule for protocol `all` from source `0.0.0.0/0` with priority 200 targeting all instances, and create an ingress ALLOW rule for protocol `tcp:443` from source `0.0.0.0/0` with priority 100 specifying `--target-service-accounts=payment-processor@prod-project.iam.gserviceaccount.com`.
  4. D
    Grant the primitive Owner role (`roles/owner`) to `[email protected]` at the project level, allowing the service account to automatically bypass the implicit VPC egress firewall controls.

Cevap

Create an egress DENY rule for protocol all to destination 0.0.0.0/0 with priority 200 targeting all instances, and create an egress ALLOW rule for protocol tcp:443 to destination 0.0.0.0/0 with priority 100 specifying --target-service-accounts=payment-processor@prod-project.iam.gserviceaccount.com.
The correct option sets up a priority 100 egress ALLOW rule targeted specifically to the payment processor service account for HTTPS traffic (`tcp:443`), alongside a priority 200 egress DENY rule for all protocols (`all`) to `0.0.0.0/0`. Because GCP evaluates lower priority numbers first (100 before 200), traffic matching the service account and port 443 is explicitly permitted, while all other outbound traffic from any instance hits the priority 200 rule and is denied before falling back to the implicit priority 65535 allow rule.

Adım Adım Çözüm

1
Analyze implicit VPC firewall rules for egress traffic.
GCP VPC networks include an implicit 'allow all egress' rule at priority 65535 (lowest precedence). To restrict egress, custom rules with higher precedence (lower priority numbers) must be created.
Explicit firewall rules are needed to override default network behavior.
2
Determine priority evaluation order for firewall rules.
GCP firewall rule priority ranges from 0 (highest precedence) to 65535 (lowest precedence). A rule with priority 100 is evaluated before a rule with priority 200.
The more specific ALLOW rule must have a smaller priority number than the general DENY rule so that permitted traffic matches first.
3
Map target requirements to gcloud parameters.
To restrict outbound traffic to specific VMs securely, use `--direction=EGRESS`, `--action=ALLOW`, `--rules=tcp:443`, `--destination-ranges=0.0.0.0/0`, and `--target-service-accounts=payment-processor@prod-project.iam.gserviceaccount.com` at priority 100, alongside a broad `--direction=EGRESS`, `--action=DENY`, `--rules=all`, `--destination-ranges=0.0.0.0/0` at priority 200.
Service accounts provide secure, identity-based target selection for firewall rules that cannot be spoofed like network tags.

Anahtar Kavram

VPC Firewall Rule Priority and Egress Target Service Account Filtering
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules