Firewall rule components (target, source, protocol) in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Identify the source in a GCP firewall rule

In a Google Cloud firewall rule, which component specifies where the incoming traffic originates from?

A The target specifies the source IP addresses or ranges.

B The source specifies the IP addresses or ranges from which traffic is allowed or denied.

C The protocol defines the source of the traffic.

D The destination specifies the source IP addresses.

💡 Hint

Think about where the traffic comes from before it reaches your resources.

The source in a firewall rule defines the IP addresses or ranges where the traffic originates. It controls which external or internal IPs can send traffic.

❓ Configuration

intermediate

Determine the target of a firewall rule

Which part of a GCP firewall rule defines the instances or resources that the rule applies to?

A The destination IP ranges.

B The protocol and ports.

C The source IP ranges.

D The target tags or service accounts.

💡 Hint

Think about which virtual machines or resources the rule protects.

The target in a firewall rule specifies which instances or resources the rule applies to, often by using network tags or service accounts.

❓ service_behavior

advanced

Effect of protocol specification in firewall rules

What happens if a GCP firewall rule specifies tcp as the protocol but traffic arrives using udp?

A The traffic is allowed because the rule applies to all protocols by default.

B The traffic is allowed only if the ports match.

C The traffic is denied because the protocol does not match the rule's specification.

D The traffic is logged but neither allowed nor denied.

💡 Hint

Consider how firewall rules filter traffic by protocol type.

Firewall rules filter traffic based on the specified protocol. If the protocol does not match, the rule does not apply, so the traffic is denied if no other rule allows it.

❓ security

advanced

Security risk of overly broad source ranges

What is a potential security risk of setting the source IP range to 0.0.0.0/0 in a GCP firewall rule?

A It allows traffic from any IP address, increasing exposure to attacks.

B It restricts access to only local network traffic.

C It blocks all incoming traffic.

D It only allows traffic from private IP addresses.

💡 Hint

Think about what 0.0.0.0/0 means in networking.

Setting source to 0.0.0.0/0 means any IP address can send traffic, which can expose resources to the internet and increase attack risk.

❓ Architecture

expert

Designing firewall rules for multi-tier applications

You have a multi-tier application with web, app, and database layers in GCP. Which firewall rule setup best isolates the database layer from direct internet access while allowing the app layer to communicate with it?

A Set the database layer's firewall rule to allow traffic only from the app layer's network tags on required ports.

B Allow the web layer to access the database layer directly on all ports.

C Allow all traffic from <code>0.0.0.0/0</code> to the database layer on all ports.

D Block all traffic to the database layer.

💡 Hint

Consider the principle of least privilege and network segmentation.

Best practice is to restrict database access only to the app layer by using network tags and specific ports, preventing direct internet access.