GCP Associate Cloud Engineer Practice Question 6: VPC Firewall Ingress Rule
Google Cloud Associate Cloud Engineer · Test 1 · question 6 of 10
You created a custom-mode VPC network and launched three instances into it, each carrying the network tag web and serving HTTP on TCP port 8080. The instances have external IP addresses and the application is confirmed to be listening on 0.0.0.0:8080 on each VM. External users report connection timeouts. gcloud compute firewall-rules list returns no rules for this network.
What should you do to make the application reachable?
Show answer and explanation
Answer:
Every VPC network carries two implied rules: an implied allow egress rule and an implied deny ingress rule. A custom-mode network you create yourself does not get the default-allow-* rules that the auto-created default network ships with, so the implied deny ingress rule blocks all inbound traffic, the exact symptom described. Adding an ingress allow rule for tcp:8080 from 0.0.0.0/0, targeted at instances with the web network tag, permits the traffic while scoping the opening to just those VMs.
Option A fixes the wrong direction. Outbound traffic is already permitted by the implied allow egress rule; an egress rule has no effect on connections initiated from the internet. Firewall rules are also stateful, so the responses to an allowed inbound connection are permitted automatically without any egress rule.
Option B is not possible. The implied rules have no configurable priority and cannot be edited or deleted, and there is no implied allow *ingress* rule to fall back on.
Option D misuses the tag field. Source tags identify the VMs *sending* traffic within the same VPC network; they cannot match external clients on the internet, so this rule would never match a user request. Target tags are what select the VMs the rule protects.
Reference: VPC firewall rules overview