Question

Your team applies a global network firewall policy to a VPC. The policy contains two rules: rule at priority 1000 denies all egress to 203.0.113.0/24 on TCP 443, and rule at priority 500 allows egress to 203.0.113.10/32 on TCP 443. A VM in the VPC attempts an HTTPS connection to 203.0.113.10. In addition, an implied allow-egress and implied deny-ingress exist at the VPC level. What is the outcome of the VM's connection, and why?

Accepted Answer

The connection is allowed because the rule at priority 500 is evaluated before the priority 1000 deny rule.

Answer

The connection is denied because the more specific /32 rule is always overridden by the broader /24 deny rule.

Answer

The connection is denied because network firewall policy rules are evaluated from highest numeric priority to lowest.

Answer

The connection is allowed only if the priority 500 rule also has a target tag matching the VM.