hardMultiple ChoiceObjective-mapped
PCSE Practice Question: You have a Compute Engine VM that hosts a custom…
You have a Compute Engine VM that hosts a custom application. The VM has a tag 'app-server' and is in a VPC network with the following firewall rules (priority order from lowest to highest):
Rule 1: Priority 1000, direction INGRESS, source 0.0.0.0/0, target tag 'app-server', protocol tcp:80, action allow Rule 2: Priority 500, direction INGRESS, source 10.0.0.0/8, target tag 'app-server', protocol tcp:80, action deny Rule 3: Priority 2000, direction INGRESS, source 192.168.0.0/16, target tag 'app-server', protocol tcp:80, action allow
A user from IP 10.0.0.5 tries to access the application on port 80. Will the request be allowed or denied?
⚠ Common exam trap
Google Cloud often tests the misconception that higher priority numbers mean higher precedence, but in Google Cloud VPC firewall rules, lower numeric priority values are evaluated first, so candidates must remember that priority 500 is evaluated before priority 1000.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Denied, because Rule 2 has a lower priority number and explicitly denies traffic from 10.0.0.0/8
Rule 2 has a priority of 500, which is lower (higher priority) than Rule 1 (priority 1000) and Rule 3 (priority 2000). Since the source IP 10.0.0.5 falls within the 10.0.0.0/8 range, Rule 2 matches first and explicitly denies the traffic. In Google Cloud VPC firewall rules, lower priority numbers are evaluated first, and the first matching rule determines the action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Denied, because Rule 2 has a lower priority number and explicitly denies traffic from 10.0.0.0/8
Why this is correct
Correct: Rule 2 has priority 500, which is evaluated before Rule 1 (1000) and Rule 3 (2000). Since it matches, the deny action is applied.
- ✗
Denied, because Rule 3 has a higher priority number and denies traffic from 192.168.0.0/16
Why it's wrong here
Rule 3 allows traffic, and its source range does not include 10.0.0.5. It does not affect this request.
- ✗
Allowed, because Rule 1 has a lower priority number and allows all traffic
Why it's wrong here
Rule 1 has priority 1000, which is higher than Rule 2 (500). Rule 2 is evaluated first and denies the traffic.
- ✗
Allowed, because Rule 3 has a higher priority number and allows traffic from 192.168.0.0/16
Why it's wrong here
Rule 3 has priority 2000, which is lower priority (higher number) than Rule 2. Since Rule 2 matches, it applies and denies.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.