A cloud engineer is deploying a custom-mode Virtual Private Cloud (VPC) network named `corp-vpc` for an enterprise environment. The requirements state that custom subnets must be created manually, and an ingress firewall rule named `allow-internal-admin` must allow SSH access (TCP port 22) exclusively to virtual machine instances carrying the target network tag `admin-node` from the internal IP subnet range `10.10.1.0/24`.
Which TWO `gcloud` commands or command options must be executed to meet these requirements? (Select TWO)
- Execute `gcloud compute networks create corp-vpc --subnet-mode=custom` to initialize the VPC network without automatic subnet creation.Cevap
- Execute `gcloud compute firewall-rules create allow-internal-admin --network=corp-vpc --allow=tcp:22 --source-ranges=10.10.1.0/24 --target-tags=admin-node` to allow SSH ingress.Cevap
- CExecute `gcloud compute networks create corp-vpc --subnet-mode=auto` and convert the subnets to custom mode after creation.
- DExecute `gcloud compute firewall-rules create allow-internal-admin --network=corp-vpc --allow=tcp:22 --source-tags=10.10.1.0/24 --target-ranges=admin-node --priority=65535` to give the allow rule highest evaluation precedence.
Cevap
Creating the VPC network using the `--subnet-mode=custom` flag and defining the firewall rule using `--source-ranges=10.10.1.0/24` with `--target-tags=admin-node` fulfills both custom subnet and network filtering requirements.
To deploy a custom VPC network, `--subnet-mode=custom` must be passed during creation to prevent default subnets from being generated. For the ingress firewall rule, `--source-ranges` correctly specifies the allowed IP block `10.10.1.0/24`, and `--target-tags` restricts the destination to instances tagged with `admin-node`.
Adım Adım Çözüm
Anahtar Kavram
Deployment of Custom VPC Networks and Ingress Firewall Rule Parameters in Google Cloud