Examkin

Question

Difficulty: Very hardDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud engineer is tasked with establishing a secure, isolated Virtual Private Cloud (VPC) environment in Google Cloud for processing sensitive financial analytics. The solution must completely block general internet egress from internal instances while allowing compute instances without external IP addresses to securely access Cloud Storage using Private Google Access. Administrative SSH management must be strictly restricted to Google Identity-Aware Proxy (IAP).

What is the correct sequential order of operational steps to provision the custom VPC infrastructure, configure regional subnetwork connectivity with Private Google Access, enforce high-priority egress allow rules for restricted Google APIs, implement fallback zero-trust egress blocking, and secure administrative ingress access?

  1. 1Execute `gcloud compute networks create finance-analytics-vpc --subnet-mode=custom` to instantiate a custom-mode Virtual Private Cloud network without default subnets.
  2. 2Execute `gcloud compute networks subnets create finance-subnet-us-east1 --network=finance-analytics-vpc --region=us-east1 --range=10.240.0.0/24 --enable-private-ip-google-access` to provision the regional subnetwork with Private Google Access enabled.
  3. 3Execute `gcloud compute firewall-rules create allow-google-apis-egress --network=finance-analytics-vpc --direction=EGRESS --priority=100 --action=ALLOW --destination-ranges=199.36.153.4/30 --rules=tcp:443` to grant outbound access to Google API virtual IP ranges.
  4. 4Execute `gcloud compute firewall-rules create deny-all-egress --network=finance-analytics-vpc --direction=EGRESS --priority=1000 --action=DENY --destination-ranges=0.0.0.0/0` to block all remaining outbound traffic.
  5. 5Execute `gcloud compute firewall-rules create allow-iap-ssh-ingress --network=finance-analytics-vpc --direction=INGRESS --priority=100 --action=ALLOW --source-ranges=35.235.240.0/20 --rules=tcp:22 --target-tags=iap-ssh-target` to allow administrative tunnel access.

Answer

The correct operational sequence begins by creating the custom VPC network (`finance-analytics-vpc`), followed by creating the regional subnet (`finance-subnet-us-east1`) with Private Google Access enabled. Next, the specific high-priority egress allow firewall rule for restricted Google APIs (199.36.153.4/30199.36.153.4/30) with priority 100100 is created. Then, the low-priority fallback egress deny firewall rule (0.0.0.0/00.0.0.0/0) with priority 10001000 is added. Finally, the ingress firewall rule for Identity-Aware Proxy (IAP) SSH access (35.235.240.0/2035.235.240.0/20) on port 2222 is applied.
The correct sequence ensures structural dependencies are satisfied first (VPC network creation, followed by subnetwork provisioning with Private Google Access). Next, egress firewall rules are established following GCP priority evaluation logic: the specific egress ALLOW rule for restricted Google APIs (199.36.153.4/30199.36.153.4/30) uses a lower numerical priority value (100100) so it is evaluated before the general egress DENY rule (0.0.0.0/00.0.0.0/0) which carries a higher numerical priority value (10001000). Finally, the IAP administrative ingress rule is applied to allow remote SSH access to internal instances.

Step-by-Step Solution

1
Provision custom VPC network baseline
Created `finance-analytics-vpc` using `--subnet-mode=custom`.
VPC networks act as the parent container. Subnets and network-scoped firewall rules cannot be instantiated until the target VPC network resource exists.
2
Provision regional subnetwork with Private Google Access
Subnet `finance-subnet-us-east1` created in `us-east1` with flag `--enable-private-ip-google-access`.
Private Google Access must be enabled at the subnet level to allow internal VMs (which lack public IPv4 addresses) to resolve and route traffic to Google APIs and Cloud Storage.
3
Configure high-priority Google API egress rule
Created egress ALLOW firewall rule with priority 100100 for destination 199.36.153.4/30199.36.153.4/30 on port 443443.
GCP evaluates firewall rules starting from the lowest numerical priority integer. Priority 100100 takes precedence over lower-priority rules such as priority 10001000.
4
Configure catch-all egress block firewall rule
Created egress DENY firewall rule with priority 10001000 targeting destination 0.0.0.0/00.0.0.0/0.
To block standard internet access while permitting Google API access, the broad 0.0.0.0/00.0.0.0/0 deny rule must possess a higher numerical priority value (e.g., 10001000) than the API allow rule (priority 100100).
5
Configure restricted administrative IAP ingress rule
Created ingress ALLOW firewall rule for TCP port 2222 sourced from 35.235.240.0/2035.235.240.0/20 targeting instances tagged `iap-ssh-target`.
Instances without public IP addresses rely on Google IAP CIDR 35.235.240.0/2035.235.240.0/20 for SSH connectivity. Defining this ingress rule secures administrative access after establishing the egress security posture.

Key Concept

Deployment sequence for custom VPC networks, Private Google Access subnet configuration, and rule priority evaluation order for GCP Firewalls.
Estimated Time:3m 0s
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules