You are implementing firewall controls to protect your compute resources in a newly created VPC. To make the protection process easier to manage and control, you've defined the hierarchical firewall…

Question

Options

• ACreate a new VPC and migrate existing resources to the new VPC. Delete the old VPC, and
• BRaise the priority numbers of the firewall policy rules and lower the priority numbers of the VPC
• CReview the order in which the VPC firewall rules and policies are evaluated. If the VPC firewall
• DLower the priority numbers of the firewall policy rules and raise the priority numbers of the VPC

• A
  4% (1)
• B
  4% (1)
• C
  82% (23)
• D
  11% (3)

Explanation

In Google Cloud, firewall rules and policies are evaluated in a strict hierarchical order: (1) Hierarchical firewall policies (org/folder level), (2) Global network firewall policies, (3) Regional network firewall policies, (4) VPC firewall rules. Rules with lower priority numbers are evaluated first within each tier. The correct approach is to review this evaluation order and verify that the VPC firewall rules are not being shadowed or overridden by higher-priority policy rules - or vice versa. Option C correctly identifies this diagnostic approach. Options B and D suggest changing priority numbers, but doing so blindly without first understanding the current evaluation flow could break existing traffic or security controls. Option A (migrating to a new VPC) is unnecessary and destructive for a configuration/order issue.

No community discussion yet for this question.