A DevOps team is deploying a multi-region network infrastructure using the Google Cloud CLI (`gcloud`). They need to configure a custom-mode Virtual Private Cloud (VPC) named `corp-vpc` with a new primary subnet in `us-central1` (). Additionally, security policies require allowing incoming HTTPS (TCP port 443) traffic exclusively to instances tagged with `frontend`, while ensuring this rule takes precedence over lower-priority default rules. Which TWO actions must be executed to successfully complete this deployment?
- Run `gcloud compute networks subnets create corp-subnet-us --network=corp-vpc --region=us-central1 --range=10.20.0.0/24` to provision the regional subnet.Cevap
- Run `gcloud compute firewall-rules create allow-frontend-https --network=corp-vpc --allow=tcp:443 --target-tags=frontend --direction=INGRESS --priority=1000` to permit HTTPS traffic to target instances.Cevap
- CSet the firewall rule priority for the HTTPS allow rule to `65534` to ensure it overrides all other rules in the VPC network.
- DApply an IAM deny policy directly on the `corp-subnet-us` resource to block all non-HTTPS ingress network traffic at the subnet boundary.
Cevap
Provisioning the custom subnet using `gcloud compute networks subnets create` with the specified network, region, and CIDR parameters, and creating an ingress firewall rule specifying `--target-tags=frontend`, `--allow=tcp:443`, and a high-precedence priority value such as 1000.
Creating a custom VPC subnet requires executing `gcloud compute networks subnets create` with the associated VPC network, region, and IP address range parameters. Controlling ingress traffic to specific VM instances requires a VPC firewall rule specifying `--direction=INGRESS`, `--target-tags`, `--allow=tcp:443`, and a priority value lower than default rules (such as 1000) to ensure high precedence.
Adım Adım Çözüm
Anahtar Kavram
Deploying custom VPC subnets and configuring target-tagged ingress firewall rules with priority precedence.