Examkin

Question

Difficulty: MediumDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

An infrastructure engineering team needs to set up a new isolated environment in Google Cloud using the `gcloud` CLI. Place the operational commands in the correct sequential order required to provision the custom VPC network, create a regional subnet, apply a targeted firewall rule, and launch a Compute Engine VM instance.

  1. 1Create the custom-mode VPC network named `enterprise-vpc` using `gcloud compute networks create enterprise-vpc --subnet-mode=custom`.
  2. 2Provision a regional subnet named `app-subnet-east` using `gcloud compute networks subnets create app-subnet-east --network=enterprise-vpc --region=us-east1 --range=10.1.0.0/24`.
  3. 3Configure an ingress firewall rule named `allow-app-ingress` using `gcloud compute firewall-rules create allow-app-ingress --network=enterprise-vpc --allow=tcp:8080 --source-ranges=10.1.0.0/24 --target-tags=app-backend`.
  4. 4Deploy the Compute Engine virtual machine instance using `gcloud compute instances create app-vm-1 --zone=us-east1-b --subnet=app-subnet-east --tags=app-backend`.

Answer

The correct operational sequence begins with initializing the custom-mode VPC network, followed by creating a regional subnet inside that network, defining a targeted ingress firewall rule on the network, and finally launching a Compute Engine VM instance attached to the subnet with matching network tags.
Provisioning Google Cloud networking resources requires adhering to strict infrastructure dependencies. A custom-mode VPC network must be instantiated first (`gcloud compute networks create --subnet-mode=custom`). Next, custom subnets must be provisioned inside that network (`gcloud compute networks subnets create`). Firewall rules bound to the VPC network must then be defined (`gcloud compute firewall-rules create`). Finally, Compute Engine VM instances can be deployed by binding them to the regional subnet and attaching network tags specified in the firewall rules (`gcloud compute instances create`).

Step-by-Step Solution

1
Execute `gcloud compute networks create enterprise-vpc --subnet-mode=custom` to create the custom-mode VPC network.
The VPC network `enterprise-vpc` is instantiated without default subnets.
Parent VPC network infrastructure must exist prior to defining subnets or network firewalls.
2
Execute `gcloud compute networks subnets create app-subnet-east --network=enterprise-vpc --region=us-east1 --range=10.1.0.0/24` to provision the subnet.
Subnet `app-subnet-east` is established within region `us-east1`.
In custom-mode VPC networks, virtual machine deployment requires pre-existing subnets in the target region.
3
Execute `gcloud compute firewall-rules create allow-app-ingress --network=enterprise-vpc --allow=tcp:8080 --source-ranges=10.1.0.0/24 --target-tags=app-backend` to apply firewall policies.
Ingress traffic on port 8080 is permitted for instances tagged `app-backend` on `enterprise-vpc`.
Firewall rules are associated directly with a VPC network and target specific instance tags.
4
Execute `gcloud compute instances create app-vm-1 --zone=us-east1-b --subnet=app-subnet-east --tags=app-backend` to deploy the VM instance.
Compute Engine instance `app-vm-1` is launched and receives an internal IP from `app-subnet-east`.
VM provisioning references the created subnet in the region and applies the network tag to inherit access rules.

Key Concept

Resource Dependency Order for Custom VPC Networks, Subnets, Firewalls, and Compute Instances
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules