PCNE Configuring Network Services Practice Question

Exhibit

NAME              DIRECTION  PRIORITY  ALLOW            SOURCE_RANGES    TARGET_TAGS
allow-http        INGRESS    1000      tcp:80          0.0.0.0/0        http-server
allow-https       INGRESS    1000      tcp:443         0.0.0.0/0        https-server
allow-ssh         INGRESS    1000      tcp:22          10.0.0.0/8       ssh-server
deny-all          INGRESS    65535     icmp,udp,tcp    0.0.0.0/0        *

Refer to the exhibit. A Compute Engine instance has the network tags 'http-server' and 'ssh-server'. It also has a public IP address. Which of the following statements about traffic to this instance is true?

⚠ Common exam trap

Google Cloud often tests the misconception that having a public IP address automatically opens all ports, or that a network tag alone (without a corresponding firewall rule) permits traffic on that port.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

HTTP traffic from the internet is allowed.

The instance has the network tag 'http-server', which is used by the default VPC firewall rule 'default-allow-http' to permit inbound TCP traffic on port 80 from any source (0.0.0.0/0). Since the instance also has a public IP address, HTTP traffic from the internet can reach it. The other tags and the public IP do not override this allow rule.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
All traffic from the internet is denied because of the deny-all rule.
Why it's wrong here
Deny-all has lower priority (65535) than allow rules (1000), so allow rules take precedence for matched traffic.
✗
SSH traffic from the internet is allowed.
Why it's wrong here
The allow-ssh rule only allows from 10.0.0.0/8 (internal IPs), so internet SSH is denied by default.
✓
HTTP traffic from the internet is allowed.
Why this is correct
The allow-http rule allows tcp:80 from 0.0.0.0/0 to tagged instances; the instance has http-server tag.
✗
HTTPS traffic from the internet is allowed.
Why it's wrong here
The allow-https rule targets https-server tag; the instance does not have this tag, so HTTPS is not allowed by that rule, and the deny-all would block it.

Go deeper

PCNE Configuring Network Services Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question