Examkin

Question

Difficulty: MediumDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud engineer is provisioning a custom-mode Virtual Private Cloud (VPC) network named `production-vpc` using the `gcloud` CLI. A new subnet named `data-subnet` must be deployed in `us-central1` with the IP range 10.120.0.0/2410.120.0.0/24. Virtual machine instances deployed in this subnet will not have external IP addresses but must be able to communicate with Google Cloud APIs and services. Furthermore, an ingress firewall rule named `allow-internal-pg` must be configured to allow TCP port 5432 traffic from 10.120.0.0/2410.120.0.0/24 to instances tagged `postgres-db`, overriding a baseline rule with priority 1000 that denies all ingress traffic to database nodes. Which two `gcloud` CLI commands or flags are required to complete this deployment correctly? (Select TWO.)

  1. Include `--enable-private-ip-google-access` when creating `data-subnet` using `gcloud compute networks subnets create` to allow VMs without external IPs to reach Google APIs.Answer
  2. Specify `--priority=500` when executing `gcloud compute firewall-rules create allow-internal-pg` to ensure the allow rule evaluates before the priority 1000 deny rule.Answer
  3. C
    Specify `--priority=2500` when executing `gcloud compute firewall-rules create allow-internal-pg` to give the allow rule higher precedence than priority 1000.
  4. D
    Pass `--enable-private-ip-google-access` to `gcloud compute networks create production-vpc` to enable Google service access globally across all subnets.

Answer

The deployment requires configuring `--enable-private-ip-google-access` at the subnet level when creating the subnet and using a priority number lower than 1000 (such as 500) for the ingress firewall rule to override the existing baseline rule.
Private Google Access is configured on individual subnets using `gcloud compute networks subnets create` with the `--enable-private-ip-google-access` flag to allow VMs with only internal IP addresses to communicate with Google services. Additionally, firewall rules in GCP process in order of priority from lowest numerical integer to highest. Therefore, to override an existing rule with priority 1000, setting `--priority=500` ensures that the allow rule takes precedence.

Step-by-Step Solution

1
Identify the required flag for enabling internal VM access to Google APIs without external IP addresses.
Private Google Access must be enabled at the subnet level (`gcloud compute networks subnets create ... --enable-private-ip-google-access`).
VPC-level networks do not accept subnet-level flags like Private Google Access.
2
Determine firewall rule priority evaluation order in GCP.
GCP evaluates firewall rules starting from 0 up to 65535. Lower numbers have higher priority.
To override a rule with priority 1000, the new rule must be assigned a priority integer less than 1000 (e.g., 500).

Key Concept

VPC Subnet Private Google Access configuration and Firewall Rule Priority Precedence
Estimated Time:1m 30s
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules