Refer to the exhibit. An engineer must provide RDP access to the AWS virtual machines and HTTPS access to the Google Cloud Platform virtual machines. All other connectivity must be blocked. The…

Question

Exhibit

Options

• AMove rule 2 to the first position.
• BConfigure a NAT overload rule
• CConfigure a virtual private cloud firewall rule
• DMove rule 1 to the last position

• A
  82% (36)
• B
  2% (1)
• C
  5% (2)
• D
  11% (5)

Explanation

Firewall rules are processed top-to-bottom, and the first matching rule wins. If Rule 1 is a "deny all" rule sitting above Rule 2 (the permit rules for RDP and HTTPS), every packet matches Rule 1 first and gets dropped - the permit rule never gets evaluated. Moving Rule 2 to position 1 ensures permitted traffic is matched and allowed before hitting the blanket deny.

Why the distractors are wrong:

• B (NAT overload): NAT handles address translation, not access control - it won't fix rule ordering.
• C (VPC firewall rule): The VPC-level cloud firewall isn't the issue; the problem is in the network firewall's rule sequence.
• D (Move rule 1 to last): If additional rules exist between Rule 1 and Rule 2 in the list, pushing Rule 1 to the bottom could allow unintended traffic to match those intermediate rules - making the policy less secure and unpredictable.

Memory tip: Think of firewall rules like a bouncer checking a list - they stop at the first match. Your "guest list" (permit rules) must always come before the "nobody else gets in" (deny all) rule, or the bouncer turns everyone away before checking the list.

No community discussion yet for this question.