A customer has an analytics workload running on Compute Engine that should have limited internet access. Your team created an egress firewall rule to deny (priority 1000) all traffic to the…

Question

Options

• ACreate an egress firewall rule to allow traffic to the CIDR range of the repository with a priority
• BCreate an egress firewall rule to allow traffic to the CIDR range of the repository with a priority
• CCreate an egress firewall rule to allow traffic to the hostname of the repository with a priority
• DCreate an egress firewall rule to allow traffic to the hostname of the repository with a priority less

• A
  5% (3)
• B
  82% (50)
• C
  11% (7)
• D
  2% (1)

Explanation

GCP firewall rules evaluate traffic based on priority - lower numbers mean higher priority. The existing deny-all egress rule sits at priority 1000. To allow traffic to the repository, the team must create an egress ALLOW rule with a priority lower than 1000 (e.g., 500) targeting the specific CIDR range of the repository. Because GCP firewall rules do not support hostnames (only IP addresses and CIDR ranges), options C and D are invalid. Option A is incorrect because a rule with a higher priority number (e.g., 65534) would be evaluated after the deny-all rule and would never take effect. Option B correctly specifies a lower priority number, ensuring the allow rule is evaluated first.

No community discussion yet for this question.