Examkin

Question

Difficulty: Very hardDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

An organization is deploying a custom VPC network environment in Google Cloud for a multi-tier application stack. A cloud engineer must create a custom subnet named `prod-app-subnet` in the `us-central1` region that includes a primary IPv4 range for Compute Engine Virtual Machines and a secondary IPv4 range reserved for GKE Pod alias IPs. Additionally, ingress TCP traffic on port 5432 (PostgreSQL) must be restricted specifically to target instances operating under a dedicated service account `[email protected]`. Which TWO actions or parameters are required to properly implement this configuration using Google Cloud best practices? (Select TWO.)

  1. Execute `gcloud compute networks subnets create prod-app-subnet` specifying `--range` for the primary internal IP allocation and `--secondary-range` to define the named subnetwork range for Pod alias IPs.Answer
  2. Configure the VPC ingress firewall rule with `--target-service-accounts=db-client-sa@proj-id.iam.gserviceaccount.com` to enforce strict identity-based access control rather than relying on network tags.Answer
  3. C
    Set the ingress database firewall rule priority value to 65535 to guarantee that it overrides all existing default network ingress allow and deny rules.
  4. D
    Grant the primitive Owner role (`roles/owner`) to `[email protected]` so that target VMs are granted implicit permission to bypass VPC ingress firewall filtering.

Answer

The correct configuration requires provisioning the subnet with both primary (`--range`) and secondary (`--secondary-range`) IP allocation flags, and applying `--target-service-accounts` on the ingress firewall rule to enforce identity-targeted network access.
Deploying custom VPC subnets with secondary IP allocations requires using `--range` for the main CIDR and `--secondary-range` for alias IP ranges. Restricting access based on instance identity requires using `--target-service-accounts` on the firewall rule rather than network tags.

Step-by-Step Solution

1
Analyze subnet provisioning flags for primary and secondary IPv4 range allocations.
Creating a custom subnet supporting secondary ranges requires the `--range` parameter for primary VM allocations and `--secondary-range` for alias IP ranges.
Google Cloud VPC subnets require explicit distinction between primary subnetwork ranges and secondary ranges intended for containers and alias IPs.
2
Evaluate ingress firewall rule parameters for service account targeting.
Using `--target-service-accounts` restricts firewall ingress strictly to instances associated with the designated IAM service account.
Service account targeting provides secure identity-based network access control that cannot be altered by modifying instance network tags.
3
Evaluate the firewall rule priority evaluation order.
A priority of 65535 is the lowest precedence rule value in GCP VPC firewalls.
Firewall rules are evaluated in ascending numerical order starting from 0 (highest precedence) to 65535 (lowest precedence).
4
Evaluate IAM role assignment in relation to network firewall filtering.
IAM roles do not grant implicit bypass permissions for network-layer firewall evaluation.
IAM authorization and VPC firewall filtering operate on separate control plane and data plane boundaries.

Key Concept

Provisioning custom VPC subnets with secondary IP ranges and defining identity-based firewall rules using service accounts.
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules