A Cloud Engineer needs to establish secure outbound internet connectivity for internal workload instances without assigning public IP addresses. The engineer must build a custom Virtual Private Cloud (VPC) network and enable Cloud NAT for a subnet in region `us-central1` using the `gcloud` CLI.
What is the correct logical sequence of steps to provision this networking architecture?
- 1Create a custom mode VPC network named `corp-vpc` using `gcloud compute networks create corp-vpc --subnet-mode=custom`.
- 2Create a subnet named `backend-subnet` within `corp-vpc` using `gcloud compute networks subnets create backend-subnet --network=corp-vpc --region=us-central1 --range=10.10.1.0/24`.
- 3Create a Cloud Router named `nat-router` in region `us-central1` using `gcloud compute routers create nat-router --network=corp-vpc --region=us-central1`.
- 4Configure a Cloud NAT gateway on `nat-router` using `gcloud compute routers nats create nat-gateway --router=nat-router --region=us-central1 --auto-allocate-nat-external-ips --nat-all-subnet-ip-ranges-all-primary-subnetworks`.
Answer
The correct sequence of steps to deploy a private subnet with Cloud NAT outbound connectivity is: 1. Create the custom mode VPC network (`corp-vpc`), 2. Create the subnet (`backend-subnet`), 3. Create the Cloud Router (`nat-router`), and 4. Configure the Cloud NAT gateway on the Cloud Router (`nat-gateway`).
The correct order follows GCP resource dependency hierarchy: creating the parent VPC network first, followed by the regional subnet, then initializing the Cloud Router within that network/region, and finally attaching the Cloud NAT gateway configuration to the Cloud Router.
Step-by-Step Solution
Key Concept
Provisioning Cloud NAT Egress Architecture in Custom VPC Networks