nerdexam
Google

PROFESSIONAL-CLOUD-NETWORK-ENGINEER · Question #50

You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in…

The correct answer is D. Create a new firewall rule with priority 65500 to deny all traffic, and enable logs. Since we have implicit ingress and the denial rule is not being logged, we create a “deny all” rule with priority 65534 to capture anything that gets denied. https://cloud.google.com/vpc/docs/firewall-rules-logging…

Submitted by andres_qro· Apr 18, 2026Implementing network security

Question

You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging. When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic. What should you do?

Options

  • ACheck the VPC flow logs for the instance.
  • BTry connecting to the instance via SSH, and check the logs.
  • CCreate a new firewall rule to allow traffic from port 22, and enable logs.
  • DCreate a new firewall rule with priority 65500 to deny all traffic, and enable logs.

How the community answered

(33 responses)
  • A
    3% (1)
  • B
    12% (4)
  • C
    6% (2)
  • D
    79% (26)

Explanation

Since we have implicit ingress and the denial rule is not being logged, we create a “deny all” rule with priority 65534 to capture anything that gets denied. https://cloud.google.com/vpc/docs/firewall-rules-logging https://cloud.google.com/blog/products/identity-security/google-cloud-firewall-rules-logging-how- and-why-you-should-use-it

Topics

#Firewall Rules#Logging#Network Security#Troubleshooting

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice