An enterprise network team is provisioning infrastructure within a custom-mode Virtual Private Cloud (VPC) named `corp-vpc` that connects to an on-premises network operating on . The requirement is to deploy a new subnet `us-east-subnet` in region `us-east1` and configure firewall rules allowing inbound SSH traffic from the on-premises range exclusively to instances tagged with `secure-bastion`. This inbound SSH rule must override a broad network-wide SSH block rule currently set with a priority of 1000.
Which TWO configuration choices or CLI operations are correct to implement this requirement? (Select TWO)
- Execute `gcloud compute networks subnets create us-east-subnet --network=corp-vpc --region=us-east1 --range=10.1.0.0/24` to provision the regional custom subnet.Answer
- Assign a numerical priority value less than 1000 (such as 500) to the targeted SSH allow firewall rule.Answer
- CAssign a numerical priority value greater than 1000 (such as 2000) to the targeted SSH allow firewall rule so it evaluates after the default block rule.
- DExecute `gcloud compute networks subnets create us-east-subnet --network=corp-vpc --region=us-east1 --range=10.100.0.0/24` to match the on-premises IP prefix.
Answer
To successfully deploy the hybrid subnet and ensure the custom ingress rule takes effect, create the subnet with a non-overlapping CIDR range () and configure the targeted SSH allow firewall rule with a priority value lower than 1000 (e.g., 500).
Google Cloud VPC firewall rule evaluation follows strict numerical ordering from 0 (highest precedence) to 65535 (lowest precedence). Therefore, setting a priority number less than 1000 ensures the targeted SSH allow rule is applied before the network-wide deny rule. Additionally, subnets created in custom VPC networks must use CIDR ranges that do not overlap with existing connected infrastructure such as on-premises networks.
Step-by-Step Solution
Key Concept
VPC Firewall Priority Precedence and Hybrid Subnet CIDR Planning