A cloud engineer is establishing a custom Virtual Private Cloud (VPC) network environment for an enterprise analytics workload. The architecture requires creating a custom-mode VPC network named `corp-analytics-vpc` and provisioning an ingress firewall rule named `allow-internal-db` that permits TCP traffic on port 5432 strictly from application instances tagged `analytics-app` to database instances tagged `analytics-db`. Which TWO commands must the engineer execute to correctly deploy this network and firewall configuration?
- gcloud compute networks create corp-analytics-vpc --subnet-mode=customAnswer
- gcloud compute firewall-rules create allow-internal-db --network=corp-analytics-vpc --allow=tcp:5432 --source-tags=analytics-app --target-tags=analytics-dbAnswer
- Cgcloud compute networks create corp-analytics-vpc --subnet-mode=auto
- Dgcloud compute firewall-rules create allow-internal-db --network=corp-analytics-vpc --allow=tcp:5432 --target-tags=analytics-app --source-tags=analytics-db
Answer
The correct configuration requires executing 'gcloud compute networks create corp-analytics-vpc --subnet-mode=custom' to instantiate the custom-mode network, along with 'gcloud compute firewall-rules create allow-internal-db --network=corp-analytics-vpc --allow=tcp:5432 --source-tags=analytics-app --target-tags=analytics-db' to allow ingress traffic from application instances to database instances.
Creating a custom-mode network requires the '--subnet-mode=custom' flag during network instantiation. For the ingress firewall rule, defining source tags as 'analytics-app' and target tags as 'analytics-db' ensures that traffic on port 5432 is evaluated correctly from originating client application instances to target database instances.
Step-by-Step Solution
Key Concept
Deploying custom-mode VPC networks and configuring tagged ingress firewall rules using gcloud CLI