Custom VPC creation in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Architecture

intermediate

VPC Subnet Allocation Strategy

You create a custom VPC in Google Cloud with three subnets in different regions. Each subnet has a CIDR block:

• Subnet A: 10.0.1.0/24
• Subnet B: 10.0.2.0/24
• Subnet C: 10.0.3.0/24

What is the total number of usable IP addresses across all subnets?

A 1024 usable IP addresses

B 753 usable IP addresses

C 765 usable IP addresses

D 750 usable IP addresses

💡 Hint

Each /24 subnet has 256 IP addresses, but some are reserved by Google Cloud.

Each /24 subnet has 256 IPs. Google Cloud reserves 5 IPs per subnet (network ID, broadcast address, and 3 for infrastructure), so usable IPs per subnet = 256 - 5 = 251. For 3 subnets: 251 * 3 = 753 usable IPs.

❓ Configuration

intermediate

Firewall Rule Priority Impact

You create two firewall rules in a custom VPC:

• Rule 1: Priority 1000, allows TCP port 22 from any source
• Rule 2: Priority 500, denies all ingress traffic

What will happen when a VM in this VPC receives a TCP connection on port 22?

A The connection is denied because deny rule has lower priority number

B The connection is allowed because allow rule has higher priority number

C The connection is denied because deny rule has higher priority number

D The connection is allowed because allow rule has lower priority number

💡 Hint

Lower priority number means higher priority in firewall rules.

Firewall rules with lower priority numbers are evaluated first. Rule 2 has priority 500 (higher priority) and denies all ingress traffic, so it blocks the connection before Rule 1 can allow it.

❓ security

advanced

Private Google Access Configuration

You have a custom VPC with private subnets that do not have external IP addresses. You want VMs in these subnets to access Google APIs securely without using public IPs.

Which configuration enables this?

A Create a Cloud NAT gateway and route traffic through it

B Assign external IPs to the VMs

C Enable Private Google Access on the subnet

D Use a VPN to connect to Google APIs

💡 Hint

Private Google Access allows VMs without external IPs to reach Google APIs.

Enabling Private Google Access on the subnet allows VMs without external IPs to access Google APIs securely over internal IPs. Cloud NAT is for internet access, not Google APIs specifically.

❓ service_behavior

advanced

Impact of Overlapping CIDR Blocks

You create two custom VPCs in the same project with overlapping CIDR blocks: 10.0.0.0/16 for both.

You try to create a VPC peering connection between them. What will happen?

A Peering connection fails due to overlapping IP ranges

B Peering connection is created successfully without issues

C Peering connection is created but traffic is blocked

D Peering connection is created but only one VPC can route traffic

💡 Hint

VPC peering requires non-overlapping IP ranges.

Google Cloud does not allow VPC peering between networks with overlapping IP ranges to avoid routing conflicts.

✅ Best Practice

expert

Designing a Highly Available Custom VPC

You need to design a custom VPC for a critical application that must remain available even if one region fails. Which design approach best supports this requirement?

A Create multiple VPCs in different regions and connect them with VPN

B Create a single subnet in one region with multiple zones

C Use a single region with a large subnet and rely on Cloud Load Balancing

D Create subnets in multiple regions and deploy resources redundantly

💡 Hint

High availability across regions requires resources in multiple regions.

Creating subnets in multiple regions and deploying resources redundantly ensures availability if one region fails. Single region or multiple VPCs with VPN do not provide seamless regional failover.