An enterprise organization maintains a custom-mode Virtual Private Cloud (VPC) network con… — Google Cloud Associate Cloud Engineer

An enterprise organization maintains a custom-mode Virtual Private Cloud (VPC) network connected to an on-premises data center ( $172.16.0.0/20$ ) via Cloud VPN. A subnet in the $us-east1$ region is currently configured with the following parameters:

- Primary IP range: $172.16.20.0/24$ (used for Compute Engine virtual machines)
- Secondary IP range: $172.16.22.0/24$ (used for Google Kubernetes Engine pod IP allocation)

Due to rapid growth, the engineering team must expand the primary IP address range of this subnet to support at least 500 Compute Engine instances. The update must be executed without replacing the subnet or causing downtime, while ensuring zero IP overlap with the existing secondary range or the on-premises network. Which primary IP address range configuration should be applied to the subnet?

Expand the primary IP range to $172.16.20.0/23$ Answer
B
Expand the primary IP range to $172.16.20.0/22$
C
Expand the primary IP range to $172.16.16.0/22$
D
Expand the primary IP range to $172.16.21.0/23$

Answer

Expand the primary IP range to

172.16.20.0/23

Expanding the primary range to

172.16.20.0/23

provides 512 total IP addresses (507 usable), satisfying the requirement for 500 instances. It starts on a valid

/23

network boundary, fully encompasses the original

172.16.20.0/24

primary range, and ends at

172.16.21.255

. This leaves the secondary range (

172.16.22.0/24

) completely unencumbered and avoids collision with the on-premises CIDR block (

172.16.0.0/20

Step-by-Step Solution

Determine required IP capacity and prefix length

To support at least 500 VM instances, a

/23

subnet mask is required (512 total addresses, 507 usable by GCP after accounting for 5 reserved addresses).

/24

subnet provides 256 addresses (251 usable), which is insufficient for 500 instances.

Analyze valid CIDR boundary alignment and primary range inclusion rules

GCP primary subnet expansion requires the new CIDR range to contain the existing primary CIDR (

172.16.20.0/24

). A

/23

block containing

172.16.20.0/24

must start on a

/23

boundary (

172.16.20.0/23

, spanning

172.16.20.0 - 172.16.21.255

Subnet ranges must be contiguous and align with standard netmask boundaries.

Verify non-overlap with secondary ranges and hybrid connectivity routes

The range

172.16.20.0/23

(

172.16.20.0 - 172.16.21.255

) does not intersect with the secondary range

172.16.22.0/24

(

172.16.22.0 - 172.16.22.255

) or the on-premises network

172.16.0.0/20

(

172.16.0.0 - 172.16.15.255

GCP prevents expanding subnets into ranges that overlap with existing secondary IP ranges or peered/VPN routes.

Key Concept

Planning primary subnet CIDR expansion in GCP Custom VPCs while respecting CIDR boundary alignment, secondary IP range isolation, and hybrid network non-overlap constraints.

Estimated Time:2m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic