Examkin

Question

Difficulty: MediumDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud administrator needs to deploy a custom Virtual Private Cloud (VPC) environment in Google Cloud using the gcloud CLI. The environment must host a web application and include a custom network, a region-specific subnet, an ingress firewall rule restricted by network target tags, and a virtual machine instance. Arrange the following administrative steps in the correct chronological execution order from first to last.

  1. 1Run `gcloud compute networks create prod-vpc --subnet-mode=custom` to create the parent VPC network.
  2. 2Run `gcloud compute networks subnets create prod-subnet-uscentral1 --network=prod-vpc --region=us-central1 --range=10.100.0.0/24` to provision the regional subnet.
  3. 3Run `gcloud compute firewall-rules create allow-prod-https --network=prod-vpc --allow=tcp:443 --target-tags=web-server` to configure the ingress firewall rule.
  4. 4Run `gcloud compute instances create web-vm-1 --zone=us-central1-a --subnet=prod-subnet-uscentral1 --tags=web-server` to deploy the Compute Engine instance.

Answer

The correct execution order is: 1) Create the custom VPC network (`prod-vpc`), 2) Provision the regional subnet (`prod-subnet-uscentral1`), 3) Create the ingress firewall rule (`allow-prod-https`), 4) Deploy the Compute Engine instance (`web-vm-1`).
In Google Cloud networking, resource creation follows a strict strict dependency hierarchy. First, the custom VPC network (`prod-vpc`) must be initialized using `--subnet-mode=custom` so that default subnets are not created. Next, a specific regional subnet (`prod-subnet-uscentral1`) must be created within that network to define the primary internal CIDR range. Third, the ingress firewall rule (`allow-prod-https`) is added to the network to allow HTTPS traffic on TCP port 443 targeted to the tag `web-server`. Finally, the Compute Engine virtual machine (`web-vm-1`) is created inside the subnet and assigned the `web-server` tag, completing the deployment.

Step-by-Step Solution

1
Create the custom-mode VPC network using `gcloud compute networks create prod-vpc --subnet-mode=custom`.
An empty custom VPC network container without auto-generated subnets is created.
Google Cloud requires a VPC network to exist before subnets or firewall rules can be attached to it.
2
Provision a regional subnet using `gcloud compute networks subnets create prod-subnet-uscentral1 --network=prod-vpc --region=us-central1 --range=10.100.0.0/24`.
A custom IP range (`10.100.0.0/24`) is allocated in `us-central1` under `prod-vpc`.
Compute Engine virtual machines in custom-mode networks require an existing subnet in their target region to bind their primary internal IP.
3
Define the ingress firewall rule using `gcloud compute firewall-rules create allow-prod-https --network=prod-vpc --allow=tcp:443 --target-tags=web-server`.
Firewall policy is attached to `prod-vpc` to permit HTTPS traffic to instances tagged `web-server`.
Establishing security policies on the network before instance creation ensures incoming traffic is properly controlled as soon as the instance provisions.
4
Deploy the Compute Engine instance using `gcloud compute instances create web-vm-1 --zone=us-central1-a --subnet=prod-subnet-uscentral1 --tags=web-server`.
The VM instance boots up attached to `prod-subnet-uscentral1` with the `web-server` network tag applied.
Instance creation requires both the target subnet and the target tags specified in previous steps.

Key Concept

Resource dependency hierarchy in GCP VPC network provisioning (VPC Network → Subnet → Firewall Rule → VM Instance).
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules