GCP Associate Cloud Engineer Practice Question

Every VPC network contains routes and two implied firewall rules: one that allows all egress traffic and one that denies all ingress traffic. Custom-mode networks do not include any additional "allow" rules. Because the administrators are trying to initiate inbound SSH sessions, traffic is being blocked by the implied deny-ingress rule. Adding a firewall rule that permits TCP 22 from the data-center's source IP range explicitly authorizes that inbound traffic. Creating routes, enabling VPC Flow Logs, or attaching a Cloud Router would not override the default firewall behavior and therefore would not solve the problem.