Firewall rules concept in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Firewall Rule Priority in GCP

In Google Cloud Platform, firewall rules have a priority number. What happens when two firewall rules apply to the same VM and have conflicting actions but different priorities?

A The rule with the lower priority number (smaller number) is applied.

B Both rules are applied, and the VM blocks traffic if either rule blocks it.

C The rule with the higher priority number (larger number) is applied.

D The rule created first is applied regardless of priority.

💡 Hint

Think about priority as a ranking where smaller numbers mean higher importance.

In GCP firewall rules, a lower priority number means higher priority. When multiple rules apply, the one with the smallest priority number is enforced first.

❓ service_behavior

intermediate

Effect of Firewall Rule Direction on Traffic

You create a firewall rule in GCP with direction set to INGRESS. Which traffic does this rule control?

A Traffic inside the VM itself.

B Traffic leaving the VM to the internet.

C Traffic between two VMs in different regions.

D Traffic entering the VM from outside sources.

💡 Hint

Ingress means 'coming in'.

Ingress firewall rules control incoming traffic to the VM, while egress rules control outgoing traffic.

❓ Configuration

advanced

Firewall Rule to Allow SSH Access Only from Specific IP

You want to create a GCP firewall rule that allows SSH (port 22) access only from the IP address 203.0.113.5. Which configuration is correct?

A Allow egress TCP traffic on port 22 to destination IP range 203.0.113.5/32.

B Allow ingress UDP traffic on port 22 from source IP range 203.0.113.5/32.

C Allow ingress TCP traffic on port 22 from source IP range 203.0.113.5/32.

D Allow ingress TCP traffic on port 22 from source IP range 0.0.0.0/0.

💡 Hint

SSH uses TCP protocol and port 22. The source IP must be exact.

To restrict SSH access to a single IP, allow ingress TCP traffic on port 22 from that IP with /32 mask for a single address.

❓ security

advanced

Impact of a Firewall Rule with Deny Action and High Priority

You create a firewall rule with deny action, priority 100, and source IP range 10.0.0.0/8. Another rule allows all traffic with priority 200. What will happen to traffic from 10.0.0.5?

A Traffic from 10.0.0.5 is allowed because the allow rule has lower priority number.

B Traffic from 10.0.0.5 is denied because the deny rule has higher priority (lower number).

C Traffic from 10.0.0.5 is allowed because deny rules are ignored if allow rules exist.

D Traffic from 10.0.0.5 is dropped randomly due to conflicting rules.

💡 Hint

Remember that lower priority numbers mean higher priority and deny rules block traffic.

The deny rule with priority 100 blocks traffic from 10.0.0.0/8 before the allow rule with priority 200 can apply.

❓ Architecture

expert

Designing Firewall Rules for Multi-Tier Application in GCP

You have a multi-tier application with web servers, app servers, and database servers in separate subnetworks. You want to allow web servers to talk to app servers on port 8080, app servers to talk to database servers on port 5432, and block all other traffic between tiers. Which firewall rule setup achieves this?

A Create allow ingress rules on app servers for TCP port 8080 from web servers' subnet, allow ingress on database servers for TCP port 5432 from app servers' subnet, and deny all other traffic between subnets.

B Create allow egress rules on web servers for TCP port 8080 to app servers' subnet, allow egress on app servers for TCP port 5432 to database servers' subnet, and allow all other traffic between subnets.

C Create allow ingress rules on all servers for all ports from all subnets, then deny ingress on database servers for port 5432.

D Create deny ingress rules on app servers and database servers for all ports, then allow ingress on web servers for port 8080.

💡 Hint

Think about controlling incoming traffic on each server tier from the correct source subnet and port.

Allowing ingress on app servers from web servers on port 8080 and on database servers from app servers on port 5432 restricts communication properly. Denying other traffic between subnets ensures no unwanted access.