PCNE Implementing VPC Instances Practice Question

A network engineer needs to create a firewall rule that denies all inbound traffic to instances with the tag 'web-server' from source IP range 10.0.0.0/8. They also have an existing allow rule with priority 1000 that permits traffic from 10.0.0.0/8 to those instances. To ensure the deny rule takes precedence, what priority should the new rule have?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

500

In GCP firewall rules, lower priority numbers have higher precedence. To override an allow rule with priority 1000, the deny rule must have a priority lower than 1000.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
1000
Why it's wrong here
Same priority would cause both to apply; deny rules are evaluated before allow, but it's not guaranteed to override.
✗
0
Why it's wrong here
0 is the lowest possible priority, but it would work; however, 500 is also correct and more typical. 0 is not necessary.
✓
500
Why this is correct
500 is lower than 1000, so the deny rule takes precedence.
✗
2000
Why it's wrong here
2000 is higher than 1000, so the allow rule would take precedence.

Visual reference

Go deeper

PCNE Implementing VPC Instances Practice Question

Why each option matters

Option-by-option breakdown

Related to this question