Examkin

Question

Difficulty: HardDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud engineer is deploying a custom-mode Virtual Private Cloud (VPC) network named `prod-vpc` to host a secure tier of web application instances in Google Cloud. The deployment specification requires creating a custom subnet named `prod-subnet-us`, defining an ingress firewall rule named `allow-prod-web` restricted to target network tag `web-frontend`, and launching a Compute Engine VM instance named `app-server-1` attached to the new subnet with the matching target tag. What is the correct chronological sequence of gcloud CLI commands to successfully provision this complete network infrastructure from scratch?

  1. 1Run `gcloud compute networks create prod-vpc --subnet-mode=custom` to construct the base VPC network container without default auto-allocated subnets.
  2. 2Run `gcloud compute networks subnets create prod-subnet-us --network=prod-vpc --region=us-central1 --range=10.130.0.0/20` to establish the specific IP address prefix.
  3. 3Run `gcloud compute firewall-rules create allow-prod-web --network=prod-vpc --allow=tcp:80,tcp:443 --target-tags=web-frontend` to configure ingress traffic boundaries.
  4. 4Run `gcloud compute instances create app-server-1 --zone=us-central1-a --subnet=prod-subnet-us --tags=web-frontend` to deploy the workload.

Answer

The correct operational sequence begins with creating the custom-mode VPC network, followed by creating the custom subnet within that network, configuring the VPC ingress firewall rule with target tags, and finally launching the Compute Engine instance bound to the custom subnet and tag.
Google Cloud resource dependencies dictate that higher-level network structures must exist before lower-level components. First, the custom VPC network (`prod-vpc`) must be created without default subnets. Second, the regional subnet (`prod-subnet-us`) must be created inside `prod-vpc`. Third, firewall rules targeting `prod-vpc` and specific tags (`web-frontend`) must be created to enforce ingress policy. Finally, the virtual machine (`app-server-1`) is created, referencing both the existing subnet for IP allocation and the network tag for firewall rule matching.

Step-by-Step Solution

1
Execute `gcloud compute networks create prod-vpc --subnet-mode=custom`
Creates the top-level custom VPC network entity in the GCP project without auto-generated subnets.
GCP resource hierarchy requires the parent VPC network to exist before subnets or network-scoped firewall policies can be defined.
2
Execute `gcloud compute networks subnets create prod-subnet-us --network=prod-vpc --region=us-central1 --range=10.130.0.0/20`
Provisions a regional custom subnet associated with `prod-vpc`.
Subnets require an existing parent VPC network (`--network=prod-vpc`) to define regional IP address ranges.
3
Execute `gcloud compute firewall-rules create allow-prod-web --network=prod-vpc --allow=tcp:80,tcp:443 --target-tags=web-frontend`
Establishes network security controls for incoming HTTP/HTTPS traffic targeting instances with tag `web-frontend`.
Firewall rules belong to a specific network (`prod-vpc`) and must be defined before or alongside instances to ensure immediate perimeter protection upon VM startup.
4
Execute `gcloud compute instances create app-server-1 --zone=us-central1-a --subnet=prod-subnet-us --tags=web-frontend`
Deploys the Compute Engine virtual machine into `prod-subnet-us` with `web-frontend` tag applied.
Instantiating a Compute Engine VM requires valid, pre-existing subnets (`--subnet`) to allocate internal IP addresses successfully.

Key Concept

GCP VPC and Compute Provisioning Dependency Order
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules