Examkin

Soru

Zorluk: OrtaDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

An infrastructure engineer is configuring ingress firewall rules for a custom Virtual Private Cloud (VPC) network. Two firewall rules are applied to Compute Engine instances with the network tag `api-server`:

- Rule 1 (`allow-internal-api`): Action: Allow, Protocol/Port: TCP:8080, Source CIDR: `10.1.0.0/16`, Priority: `1000`.
- Rule 2 (`deny-partner-api`): Action: Deny, Protocol/Port: TCP:8080, Source CIDR: `10.1.5.0/24`, Priority: `500`.

A client host at IP address `10.1.5.25` attempts a TCP connection on port 8080 to an `api-server` instance. How will Google Cloud VPC firewall rule evaluation process this traffic request?

  1. The traffic will be denied because Rule 2 has a lower priority number (500), giving it higher precedence over Rule 1 (1000).Cevap
  2. B
    The traffic will be allowed because Rule 1 has a higher numerical priority (1000), giving it precedence over Rule 2 (500).
  3. C
    The traffic will be allowed because explicit Allow rules automatically take precedence over Deny rules regardless of numerical priority.
  4. D
    The traffic will be blocked because the overlapping source CIDR ranges (`10.1.0.0/16` and `10.1.5.0/24`) create an illegal conflict that disables both rules.

Cevap

The traffic will be denied because Rule 2 has a lower priority number (500), giving it higher precedence over Rule 1 (1000).
In Google Cloud Virtual Private Cloud (VPC), firewall rules are evaluated in ascending numerical order of their priority values (from 0 to 65535). A lower integer value represents a higher priority. Because priority 500 is lower than priority 1000, Rule 2 (`deny-partner-api`) is evaluated first. Since the incoming IP address `10.1.5.25` falls within `10.1.5.0/24`, Rule 2 matches and immediately denies the connection.

Adım Adım Çözüm

1
Identify matching firewall rules for incoming traffic.
Both Rule 1 (Source `10.1.0.0/16`) and Rule 2 (Source `10.1.5.0/24`) match traffic from `10.1.5.25` on TCP port 8080 targeting instances with tag `api-server`.
Traffic matching requires evaluating target tags, protocols, ports, and source IP CIDRs.
2
Compare the priority numbers of the matching rules.
Rule 2 has priority 500, while Rule 1 has priority 1000.
GCP evaluates firewall rules in ascending order of priority integer value (0 to 65535, where 0 is evaluated first).
3
Determine the outcome based on the highest precedence rule.
Rule 2 takes precedence due to its lower priority number (500 < 1000), executing its action (Deny).
Once a matching rule with the lowest numerical priority is found, its action is applied and evaluation stops.

Anahtar Kavram

GCP VPC Firewall Rule Priority Precedence
Bu soruyu puanla

Konular

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules