PCA Question 90

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  Priority-Based Evaluation: Google Cloud VPC firewall rules are evaluated based on their priority number, from 0 to 65535. A lower numerical value signifies a higher priority. The first rule that matches the traffic is the one that gets applied. Overriding Implied Rules: Every VPC network has an implied allow egress rule with the lowest possible priority (65535) that permits all outbound traffic by default. To block "all other traffic," you must create a custom rule with a higher priority (a lower number like 1000) to override this default behavior.

• 1

  Selective Allowance (Least Privilege): To allow the specific Active Directory traffic, you need a rule with an even higher priority (a lower number like 100) than your "deny all" rule. This ensures that when an instance attempts to reach the AD server, it hits the "allow" rule (priority 100) first. If the traffic is destined anywhere else, it will miss the first rule and be caught by the "deny all" rule (priority 1000).

• 2

  B. Create an egress rule with priority 100 to deny all traffic for all instances. Create another egress rule with priority 1000 to allow the Active Directory traffic for all instances. This option creates a deny all rule with a lower priority and an allow rule with a higher priority. This option will work as intended, as the Active Directory traffic will be allowed and all other outbound traffic will be blocked.