Examkin

Question

Difficulty: Very hardDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud engineer needs to deploy a custom Virtual Private Cloud (VPC) infrastructure in Google Cloud to host secure internal applications. The requirements specify creating a VPC network without automatic subnet creation, provisioning a regional subnet, launching a Compute Engine VM with a specific network tag in that subnet, and enforcing an ingress firewall rule that allows SSH traffic (TCP port 22) exclusively to instances carrying that network tag. In what order should the engineer execute the following `gcloud` CLI commands to ensure all resource dependencies are satisfied without errors?

  1. 1Execute `gcloud compute networks create enterprise-vpc --subnet-mode=custom` to create the VPC network container.
  2. 2Execute `gcloud compute networks subnets create prod-subnet-us-central1 --network=enterprise-vpc --region=us-central1 --range=10.10.0.0/24` to provision the regional custom subnet.
  3. 3Execute `gcloud compute instances create app-vm-1 --zone=us-central1-a --subnet=prod-subnet-us-central1 --tags=bastion-ssh-target` to launch the virtual machine with the designated network tag.
  4. 4Execute `gcloud compute firewall-rules create allow-bastion-ssh --network=enterprise-vpc --direction=INGRESS --priority=1000 --action=ALLOW --rules=tcp:22 --target-tags=bastion-ssh-target` to deploy the target-filtered firewall rule.

Answer

The correct operational sequence begins with provisioning the parent VPC network in custom subnet mode (`gcloud compute networks create --subnet-mode=custom`), followed by creating the regional custom subnet inside that network (`gcloud compute networks subnets create`), then launching the Compute Engine VM instance attached to the subnet with the designated network tag (`gcloud compute instances create --tags`), and finally creating the ingress firewall rule configured with matching target tags on the VPC network (`gcloud compute firewall-rules create --target-tags`).
Resource creation in Google Cloud networking strictly follows a hierarchical dependency structure: Network → Subnet → Compute Instance with Tags → Firewall Rule targeting Tags. Creating the VPC network with `--subnet-mode=custom` establishes the network container. Next, explicit creation of the regional subnet defines the IP address space. The VM instance is then provisioned into that subnet and assigned network tags. Finally, the firewall rule targeting those network tags is created on the network.

Step-by-Step Solution

1
Create the custom VPC network
The VPC network `enterprise-vpc` is created in custom mode with no default regional subnets.
VPC subnets, compute instances, and firewall rules depend on a pre-existing VPC network resource.
2
Create the regional custom subnet within the VPC network
The subnet `prod-subnet-us-central1` with CIDR `10.10.0.0/24` is created in `us-central1`.
In custom mode VPCs, subnets are not created automatically; instances cannot be provisioned without specifying an existing subnet.
3
Provision the Compute Engine VM instance in the custom subnet with the network tag
The instance `app-vm-1` receives an IP in `10.10.0.0/24` and is labeled with the tag `bastion-ssh-target`.
Target network tags must be present on instance metadata for tag-based firewall filtering to evaluate and route traffic to the intended host.
4
Deploy the ingress firewall rule filtering by target network tag
An ingress rule allowing TCP port 22 is attached to `enterprise-vpc`, targeting only instances tagged `bastion-ssh-target`.
Firewall rules reference the VPC network and filter traffic directed to tagged compute workloads.

Key Concept

GCP VPC Resource Dependency Hierarchy and Deployment Sequencing
Estimated Time:2m 30s
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules