Shared VPC concept in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Shared VPC Host Project Role

In Google Cloud, which role must a project have to act as a Shared VPC host?

A The project must be a host project with Network Admin role.

B The project must be a service project with Compute Network User role.

C The project must be a service project with Owner role.

D The project must be a host project with Compute Viewer role.

💡 Hint

Think about which project controls the network resources.

The Shared VPC host project owns the network and requires the Network Admin role to manage it. Service projects use the network but do not own it.

❓ Architecture

intermediate

Shared VPC Service Project Resource Access

Which statement best describes how a service project accesses resources in a Shared VPC?

A Service projects cannot use Shared VPC networks; they only use peered networks.

B Service projects use subnets from the host project's VPC network but manage their own firewall rules.

C Service projects create and manage their own VPC networks independently.

D Service projects use subnets from the host project's VPC network and rely on host project firewall rules.

💡 Hint

Consider who controls the network and security policies.

Service projects use subnets from the host project's VPC network. Firewall rules are managed at the host project level, so service projects rely on those rules.

❓ security

advanced

Shared VPC Security Best Practice

Which practice improves security when using Shared VPC across multiple service projects?

A Grant all users Owner role on the host project to simplify management.

B Use IAM roles to grant least privilege access to service projects for network resources.

C Allow service projects to create their own firewall rules to increase flexibility.

D Disable VPC Service Controls to avoid access restrictions.

💡 Hint

Think about minimizing permissions to reduce risk.

Granting least privilege using IAM roles limits access to only what is necessary, improving security. Owner role grants too many permissions. Firewall rules are managed centrally. VPC Service Controls enhance security.

❓ service_behavior

advanced

Impact of Removing a Service Project from Shared VPC

What happens to the VM instances in a service project when it is detached from the Shared VPC host project?

A VM instances continue running with the same network configuration without interruption.

B VM instances are deleted automatically upon detachment.

C VM instances lose network connectivity immediately and cannot communicate externally.

D VM instances are automatically migrated to a new VPC network in the service project.

💡 Hint

Consider what happens when the network is no longer attached.

When a service project is detached from the Shared VPC, its VM instances lose access to the host project's network and lose network connectivity immediately.

✅ Best Practice

expert

Designing Shared VPC for Multiple Departments

You manage a Shared VPC for multiple departments in your organization. Which design approach best isolates network traffic while using a single Shared VPC host project?

A Create separate subnets per department and use firewall rules to restrict traffic between them.

B Use a single subnet for all departments and rely on VM tags for traffic control.

C Create multiple Shared VPC host projects, one per department, to isolate networks.

D Allow all departments to share the same subnet and firewall rules for simplicity.

💡 Hint

Think about network segmentation within a Shared VPC.

Creating separate subnets per department and applying firewall rules to restrict traffic is the best practice to isolate network traffic while using a single Shared VPC host project. Multiple host projects increase complexity.