Examkin

Question

Difficulty: EasyDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud engineer needs to deploy a new custom Virtual Private Cloud (VPC) network, provision a regional subnet, and enforce ingress traffic security for a specific web server instance using network tags. Arrange the following deployment steps in the correct order from first to last.

  1. 1Create a custom-mode VPC network without automatically generated subnets.
  2. 2Provision a subnet in the designated region by assigning a primary IP address range to the custom VPC network.
  3. 3Create an ingress firewall rule bound to the VPC network specifying allowed ports and target network tags.
  4. 4Apply the matching network tag to the target Compute Engine virtual machine instance.

Answer

The correct operational order is to first create the custom-mode VPC network, then provision the regional subnet with an IP range, followed by creating the target-tagged ingress firewall rule in the VPC, and finally assigning the network tag to the Compute Engine VM instance.
In Google Cloud networking, resource creation follows a strict parent-to-child structural dependency. The custom VPC network must be created first because subnets and firewall rules are child resources of the VPC. The regional subnet defines the IP space, while the firewall rule defines access controls within that network. Finally, attaching the network tag to the virtual machine enables the matching firewall rule for that instance.

Step-by-Step Solution

1
Create the custom VPC network container
An empty custom VPC network is established without default automatic subnets.
Google Cloud infrastructure resources such as subnets and firewall rules depend on a parent VPC network object.
2
Create a regional subnet with a CIDR range
A explicit IP address block is allocated in a specific region within the custom VPC network.
Compute instances require a subnet within a specific region to allocate internal IP addresses.
3
Define a firewall rule targeting a specific network tag
The VPC network registers an ingress filtering rule configured to allow traffic for instances carrying the target tag.
Firewall rules belong to the VPC network level and must be defined before instance tag matching takes effect.
4
Assign the network tag to the target VM instance
The firewall rule dynamically applies ingress filtering to the virtual machine instance.
Network tags on Compute Engine instances trigger matching VPC firewall rules.

Key Concept

Provisioning Custom VPC Networks, Subnets, and Tag-Based Firewall Rules
Estimated Time:1m 0s
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules