Exam Associate Cloud Engineer topic 1 question 151 discussion

Correct Answer is (A): Implied rules Every VPC network has two implied firewall rules. These rules exist, but are not shown in the Cloud Console: Implied allow egress rule. An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535) lets any instance send traffic to any destination, except for traffic blocked by Google Cloud. A higher priority firewall rule may restrict outbound access. Internet access is allowed if no other firewall rules deny outbound traffic and if the instance has an external IP address or uses a Cloud NAT instance. For more information, see Internet access requirements. Implied deny ingress rule. An ingress rule whose action is deny, source is 0.0.0.0/0, and priority is the lowest possible (65535) protects all instances by blocking incoming connections to them. A higher priority rule might allow incoming access. The default network includes some additional rules that override this one, allowing certain types of incoming connections. https://cloud.google.com/vpc/docs/firewalls#default_firewall_rules

Answer is (A) : First I was going with C but then I read the question again, let's try to understand both options here, the goal is to deny egress and only allow some ports for some functions to perform. If we go with C, lower the number higher the priority (1000) so the rule with this priority 1000 will overwrite (65534), so If we allow only appropriate ports it will be overwritten with the high-priority (1000) rule and all the egress traffic will be blocked. Remember the goal here is to block egress but not all of it since we still want to configure the fewest open ports and this is statefull meaning for open ports traffic will be both ways. A fits this condition where it is saying we block all traffic but the required ports are kept open with higher priority which will only allow the required traffic to leave the network.

Default Egress Behavior: In Google Cloud VPCs, the default behavior is to allow all egress traffic. To restrict egress traffic effectively, you need to explicitly set up firewall rules. Blocking All Egress Traffic: The low-priority rule (priority 65534, near the lowest priority) should be configured to block all egress traffic. This creates a baseline rule that denies all egress traffic by default. Allowing Specific Ports: The high-priority rule (priority 1000, indicating a higher priority) should be set to allow egress traffic only on the specific ports that are required for the application. Since firewall rules are evaluated in order of priority, this rule will override the default block for these specific ports.

Correct answer is C: By implementing a high-priority rule to block all egress traffic (since it has a lower number than lower-priority rules), and a low-priority rule to selectively allow specific necessary egress ports (with a higher number), you minimize open egress ports to only the required ones while restricting the rest.

The rule is evaluated on higher priority to lower priority and depends first come first serve basis. https://cloud.google.com/firewall/docs/firewall-policies-overview#rule-evaluation

A is the correct answer

Correct answer is A. Answer will not be D, because Egress traffic is Allowed by default. You will have to explicitly set the rule blocking outbound traffic.

Read ESP_SAP comment for the explanation. He explains it clearly.

C is the correct answer

A: is the answer

Correct answer is A

Correct Answer is C

A incorrect 65534 that blocks all ingress, not egress (except few default ports) D is correct.

Correct Answer is A

I vote A is correct. Block all port in gress and set low-priority.

A is correct

Correct answer is A. Firewall rules are executed based on the priority.