PCNE Implementing VPC Instances Practice Question

Correct answer & explanation

Hierarchical firewall policies can be applied at the organization or folder level and have priority over VPC-level rules. By setting a low-priority allow rule at the project level, you can override a higher-priority deny rule if the policy allows overrides. However, hierarchical firewall policies have a higher precedence than network firewall rules; a deny at the org level cannot be overridden by a lower-precedence allow at the VPC level. The correct approach is to use a hierarchical firewall policy with a deny rule at high priority (e.g., 100) and allow exceptions at lower priority (e.g., 1000) for specific projects via tags or service accounts. But careful: If you set a deny rule with priority 100 at org level, and an allow rule with priority 200 at project level, the deny takes precedence because it has higher priority (lower number). To allow exceptions, you need to set the allow rule at a priority level that is evaluated first (lower number) than the deny. So you need to allow at lower number (e.g., 10) and deny at higher number (e.g., 1000). But that would allow all. The correct architecture is to use hierarchical firewall policies with both rules: allow SSH for specific targets at priority 1000, and deny SSH for all at priority 2000. The allow rule with lower number takes precedence for matching targets. Actually, evaluation order: priority lower number = higher priority. So if you want to allow some and deny others, you need to set allow rules with higher priority (lower number) than deny rules. So you can have a hierarchical firewall policy with an allow rule for specific tags (e.g., 'allowed-ssh') at priority 1000, and a deny rule for all at priority 2000. Then, in projects that need SSH, you apply the tag to instances. But the question says 'must allow certain projects to override this'. The best way is to use a network firewall policy (VPC-level) that can be applied per VPC, allowing override at the project level. However, hierarchical firewall policies are evaluated before network firewall rules. To override, you would need to use a hierarchical policy with higher priority to allow. The simplest answer is to use a network firewall policy at the VPC level and an organization policy that grants exception. But given options, the correct one likely involves using a network firewall policy with appropriate priority. Let's analyze: Option A: Create a hierarchical firewall policy at the organization level with a deny rule for SSH. Then create a network firewall policy at the VPC level with an allow rule for SSH. However, hierarchical firewall policies are evaluated before network firewall policies, and the deny would block SSH even if network firewall allows. So that doesn't work. Option B: Create a network firewall policy with a deny rule for SSH and use service accounts to allow exceptions. But that doesn't apply across projects. Option C: Use a hierarchical firewall policy with both allow and deny rules, setting allow at a higher priority (lower number) for specific projects. This allows override. Option D: Use VPC Service Controls to block SSH. This is not relevant. So the answer is likely C.

Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.