PCNE Implementing VPC Instances Practice Question

Correct answer & explanation

Priority lower number = higher priority. The allow rule at priority 1000 should allow HTTP. However, if there is a default deny ingress rule (priority 65535) that denies all, the allow rule should override it. But if there is a higher priority deny rule (lower number) that blocks HTTP, that would cause the issue. The scenario likely includes a hidden deny rule or misconfiguration. The most common cause is that the allow rule has a lower priority than a deny rule that matches. But the given allow rule has priority 1000, which is higher than 65535. So it should work. Maybe the firewall rule is not applied because the target tag is not assigned? Or the rule is in the wrong VPC. The question is tricky. Possibly the issue is that the default deny ingress rule has priority 65535 and is overridden, but the rule might be an implied deny? Actually, VPCs have an implied deny ingress rule at priority 65535. That should be overridden by the allow rule. So if it's not working, the cause could be that the allow rule has a lower priority than the deny rule? No. Maybe there is a hierarchical firewall policy denying. But the scenario doesn't mention that. The best answer: The target tag 'web' is not applied to the VM. But that's not a firewall rule issue per se. The possible correct answer: The firewall rule's source IP range is incorrect. But it's 0.0.0.0/0. I'll go with: The VM does not have the network tag 'web' assigned. However, options might include that. Let's construct options: A) The firewall rule is egress instead of ingress; B) The VM does not have the network tag 'web'; C) The priority is too low; D) There is a conflicting route. The correct one: B.

Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.