Examkin

Question

Difficulty: HardDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A systems administrator needs to deploy a secure workload in Google Cloud Platform using the `gcloud` CLI. The design requires a custom-mode Virtual Private Cloud network named `prod-vpc`, a dedicated regional subnet named `prod-subnet-uscentral1` (10.2.0.0/2410.2.0.0/24), an ingress firewall rule permitting SSH traffic to instances with a specific network tag, and a Compute Engine VM instance associated with this configuration. In what chronological order must these administrative commands be executed?

  1. 1Execute `gcloud compute networks create prod-vpc --subnet-mode=custom` to instantiate the parent network container.
  2. 2Execute `gcloud compute networks subnets create prod-subnet-uscentral1 --network=prod-vpc --region=us-central1 --range=10.2.0.0/24` to establish the regional IP address range.
  3. 3Execute `gcloud compute firewall-rules create allow-prod-ssh --network=prod-vpc --allow=tcp:22 --target-tags=ssh-enabled` to establish network access policy.
  4. 4Execute `gcloud compute instances create prod-app-vm --zone=us-central1-a --subnet=prod-subnet-uscentral1 --tags=ssh-enabled` to provision the workload instance.

Answer

The correct sequence begins with creating the custom VPC network (`prod-vpc`), followed by provisioning the custom subnet (`prod-subnet-uscentral1`) within that network. Next, the ingress firewall rule (`allow-prod-ssh`) is created on the VPC network targeting the `ssh-enabled` tag. Finally, the VM instance (`prod-app-vm`) is created referencing the subnet and applying the target tag.
Google Cloud infrastructure management follows strict parent-child resource dependencies. A custom VPC network must be created first to act as the parent container. Next, regional subnets must be allocated within that network to provide IP addresses. Ingress firewall rules are defined at the VPC network level using target tags. Finally, Compute Engine instances are launched into the existing subnet and tagged to inherit the firewall rules.

Step-by-Step Solution

1
Create the custom-mode VPC network.
Instantiates `prod-vpc` without automatically generating default subnets across regions.
In custom-mode VPCs, subnets cannot be created until the parent VPC network exists.
2
Create the regional custom subnet.
Allocates IP range 10.2.0.0/2410.2.0.0/24 in `us-central1` associated with `prod-vpc`.
Compute Engine instances in a custom VPC require an active subnet in their deployment zone/region to receive IP configuration.
3
Configure the VPC ingress firewall rule with target tags.
Applies a network rule to `prod-vpc` allowing TCP port 22 ingress for instances carrying the `ssh-enabled` tag.
Firewall rules are associated with the VPC network and should be established prior to or alongside VM deployment so security parameters are defined.
4
Deploy the Compute Engine virtual machine instance.
Launches `prod-app-vm` in `us-central1-a`, attached to `prod-subnet-uscentral1` and tagged with `ssh-enabled`.
The instance command explicitly references both the pre-existing subnet name and the network tag evaluated by the firewall rule.

Key Concept

Resource dependencies and execution ordering when provisioning custom VPC networks, subnets, firewall rules, and instances via gcloud CLI.
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules