Your company uses VPC firewall rules and denies all egress traffic. You need to allow some VMs to contact external websites based on their fully qualified domain name (FQDN). You apply the new…

The correct answer is C. Update the default policy and rule evaluation order to BEFORE_CLASSIC_FIREWALL. Network firewall policies that use FQDN-based rules are, by default, evaluated after the classic VPC firewall rules. Your “deny all egress” VPC rule takes effect first and blocks the traffic before your FQDN allow rules are ever reached. Switching the policy evaluation order to…

Submitted by lucia.co· Apr 18, 2026Implementing network security

Question

Your company uses VPC firewall rules and denies all egress traffic. You need to allow some VMs to contact external websites based on their fully qualified domain name (FQDN). You apply the new configuration, but the traffic is still denied. You need to adjust your setup to apply the new configuration. What would you do?

Options

ARaise the priority of the network firewall policy rules.
BLower the priority of the network firewall policy rules.
CUpdate the default policy and rule evaluation order to BEFORE_CLASSIC_FIREWALL.
DUpdate the default policy and rule evaluation order to AFTER_CLASSIC_FIREWALL.

How the community answered

(23 responses)

A
4% (1)
B
9% (2)
C
83% (19)
D
4% (1)

Explanation

Network firewall policies that use FQDN-based rules are, by default, evaluated after the classic VPC firewall rules. Your “deny all egress” VPC rule takes effect first and blocks the traffic before your FQDN allow rules are ever reached. Switching the policy evaluation order to BEFORE_CLASSIC_FIREWALL ensures your FQDN-based allow rules run first, letting the designated VMs reach external sites, while still preserving your broader deny-all egress rule.

Topics

#Network Firewall Policies#VPC Firewall Rules#Firewall Rule Evaluation Order#FQDN Filtering

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice