PCNE Implementing VPC Instances Practice Question
A network engineer needs to create a firewall rule that blocks all ingress traffic from the internet to Compute Engine instances tagged 'web-server', except for traffic from the organization's VPN gateway at IP 203.0.113.1. The engineer creates a rule with priority 1000, deny ingress, source IP ranges 0.0.0.0/0, and targets 'web-server'. To allow the VPN IP, what should the engineer do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new allow rule with priority 500, source IP 203.0.113.1/32, target 'web-server', and action allow.
Firewall rules are evaluated in order of priority (lower number = higher priority). The deny rule at priority 1000 will deny all IPs. To allow the VPN IP, a higher priority (lower number) allow rule must be created for that specific IP, before the deny rule is evaluated. The correct approach is to create an allow rule with priority 100 (or any lower number) for source IP 203.0.0.0/8 (or the specific IP) targeting web-server.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the existing deny rule to include an exception for the VPN IP in the source IP field.
Why it's wrong here
Firewall rules do not support exceptions in source IPs; you need multiple rules.
- ✗
Delete the deny rule and create a single rule that denies all IPs except the VPN IP using the 'except' option.
Why it's wrong here
Firewall rules do not have an 'except' source IP option; you must use multiple rules.
- ✓
Create a new allow rule with priority 500, source IP 203.0.113.1/32, target 'web-server', and action allow.
Why this is correct
This allow rule has higher priority (lower number) than the deny rule, so traffic from the VPN IP will be allowed before the deny rule applies.
- ✗
Change the priority of the existing deny rule to 1 and create an allow rule with priority 2 for the VPN IP.
Why it's wrong here
Priority 1 would deny everything first, making the allow rule at priority 2 ineffective.
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.