Examkin

Soru

Zorluk: OrtaDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud engineer needs to deploy a custom enterprise environment in Google Cloud using the Google Cloud CLI (`gcloud`). The environment requires a custom VPC network, a dedicated subnet in `us-central1`, a restrictive ingress firewall rule for web application traffic, and a Compute Engine VM instance. Arrange the operational steps in the correct chronological sequence required to provision this infrastructure successfully.

  1. 1Create the custom-mode VPC network 'prod-vpc' using 'gcloud compute networks create prod-vpc --subnet-mode=custom'.
  2. 2Create the subnet 'prod-app-subnet' inside 'prod-vpc' using 'gcloud compute networks subnets create prod-app-subnet --network=prod-vpc --region=us-central1 --range=10.10.1.0/24'.
  3. 3Create the ingress firewall rule 'allow-app-ingress' on 'prod-vpc' targeting network tag 'app-server' on TCP port 8080 using 'gcloud compute firewall-rules create allow-app-ingress --network=prod-vpc --allow=tcp:8080 --target-tags=app-server'.
  4. 4Deploy the Compute Engine VM instance 'app-vm-1' in 'us-central1' using 'gcloud compute instances create app-vm-1 --zone=us-central1-a --subnet=prod-app-subnet --tags=app-server'.

Cevap

The correct sequence of operations is: (1) Create the custom-mode VPC network 'prod-vpc', (2) Create the custom subnet 'prod-app-subnet' within the VPC, (3) Create the ingress firewall rule 'allow-app-ingress' targeting tag 'app-server', and (4) Deploy the Compute Engine VM instance 'app-vm-1' attached to 'prod-app-subnet' with tag 'app-server'.
In Google Cloud, infrastructure provisioning follows a strict dependency hierarchy. First, the custom VPC network container must be created (`gcloud compute networks create --subnet-mode=custom`). Second, regional subnets are created inside that VPC (`gcloud compute networks subnets create`). Third, firewall rules are established on the VPC network specifying target network tags (`gcloud compute firewall-rules create`). Finally, Compute Engine VM instances are deployed into the designated subnet and tagged appropriately (`gcloud compute instances create --subnet ... --tags ...`) so that network routing and firewall policies apply immediately.

Adım Adım Çözüm

1
Initialize the parent custom VPC network
Network resource 'prod-vpc' exists with auto-subnet creation disabled.
Custom subnets cannot be created without a parent VPC network existing first.
2
Provision the custom subnet
Subnet 'prod-app-subnet' is established in region 'us-central1'.
VM instances require a specific subnet for IP allocation when operating in a custom mode network.
3
Configure network firewall ingress rule
Firewall rule 'allow-app-ingress' is created under network 'prod-vpc'.
Security controls should be defined on the VPC before launching instances to ensure traffic is governed properly upon boot.
4
Deploy Compute Engine VM instance with network tag
VM instance 'app-vm-1' is instantiated inside 'prod-app-subnet' with target tag 'app-server'.
The instance references both the subnet for connectivity and the network tag to inherit the firewall rule configuration.

Anahtar Kavram

Deployment dependency order for GCP VPC networks, subnets, firewall rules, and compute instances.
Bu soruyu puanla

Konular

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules