All compute Engine instances in your VPC should be able to connect to an Active Directory server on specific ports. Any other traffic emerging from your instances is not allowed. You want to enforce…

Question

Options

• ACreate an egress rule with priority 1000 to deny all traffic for all instances. Create another egress
• BCreate an egress rule with priority 100 to deny all traffic for all instances. Create another egress
• CCreate an egress rule with priority 1000 to allow the Active Directory traffic. Rely on the implied
• DCreate an egress rule with priority 100 to allow the Active Directory traffic. Rely on the implied

• A
  59% (10)
• B
  12% (2)
• C
  24% (4)
• D
  6% (1)

Explanation

https://cloud.google.com/vpc/docs/firewalls#default_firewall_rules Every VPC network has two implied firewall rules. These rules exist, but are not shown in the The implied allow egress rule: An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535) lets any instance send traffic to any destination, except for traffic blocked by GCP. Outbound access may be restricted by a higher priority firewall rule. Internet access is allowed if no other firewall rules deny outbound traffic and if the instance has an external IP address or uses a NAT instance. Refer to Internet access requirements for more The implied deny ingress rule: An ingress rule whose action is deny, source is 0.0.0.0/0, and priority is the lowest possible (65535) protects all instances by blocking incoming traffic to them. Incoming access may be allowed by a higher priority rule. Note that the default network includes some additional rules that override this one, allowing certain types of incoming traffic.

No community discussion yet for this question.