Shared VPC concept in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the host project for a Shared VPC.

GCP

resource "google_compute_shared_vpc_host_project" "host" {
  project = "[1]"
}

Drag options to blanks, or click blank then click option'

Amy-shared-vpc-host

Brandom-project

Cmy-service-project

Dunrelated-project

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing the host project with the service project.

Using a project that does not own the VPC network.

The host project is the project that owns the Shared VPC network. It must be specified correctly to enable Shared VPC.

2fill in blank

medium

Complete the code to attach a service project to the Shared VPC host project.

GCP

resource "google_compute_shared_vpc_service_project" "service" {
  host_project = "my-shared-vpc-host"
  service_project = "[1]"
}

Drag options to blanks, or click blank then click option'

Amy-service-project

Bmy-shared-vpc-host

Canother-host-project

Drandom-project

Attempts:

3 left

💡 Hint

Common Mistakes

Using the host project name instead of the service project.

Using a project that is not linked to the Shared VPC.

The service project is the project that uses the Shared VPC network from the host project.

3fill in blank

hard

Fix the error in the IAM binding to allow the service project to use the Shared VPC network.

GCP

resource "google_project_iam_member" "service_network_user" {
  project = "my-shared-vpc-host"
  role    = "roles/[1]"
  member  = "serviceAccount:[e-mail]"
}

Drag options to blanks, or click blank then click option'

Aroles.viewer

Bcompute.admin

Ccompute.networkAdmin

Dcompute.networkUser

Attempts:

3 left

💡 Hint

Common Mistakes

Using roles with too many permissions like admin.

Using roles that do not allow network usage.

The role compute.networkUser allows the service project to use the Shared VPC network resources.

4fill in blank

hard

Fill both blanks to create a firewall rule in the Shared VPC host project allowing SSH from the service project.

GCP

resource "google_compute_firewall" "allow_ssh" {
  name    = "allow-ssh"
  network = "projects/my-shared-vpc-host/global/networks/[1]"
  allow {
    protocol = "tcp"
    ports    = ["22"]
  }
  source_ranges = ["[2]"]
}

Drag options to blanks, or click blank then click option'

Ashared-vpc-network

B10.0.0.0/8

Cdefault

D192.168.1.0/24

Attempts:

3 left

💡 Hint

Common Mistakes

Using the default network instead of the Shared VPC network.

Using incorrect or too narrow IP ranges.

The firewall rule must specify the Shared VPC network name and the IP range of the service project to allow SSH traffic.

5fill in blank

hard

Fill all three blanks to define a subnet in the Shared VPC host project with private IP Google access enabled.

GCP

resource "google_compute_subnetwork" "shared_subnet" {
  name          = "shared-subnet"
  ip_cidr_range = "[1]"
  region        = "us-central1"
  network       = "projects/my-shared-vpc-host/global/networks/[2]"
  private_ip_google_access = [3]
}

Drag options to blanks, or click blank then click option'

A10.10.0.0/16

Bshared-vpc-network

Ctrue

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Using an incorrect network name.

Disabling private IP Google access when it is needed.

The subnet must have a valid CIDR range, be attached to the Shared VPC network, and enable private IP Google access for private communication with Google services.

Practice

1. What is the main purpose of a Shared VPC in Google Cloud Platform?

easy

A. To automatically back up virtual machines across projects

B. To create multiple isolated networks within a single project

C. To allow multiple projects to share the same Virtual Private Cloud network

D. To enable direct internet access for all projects

Solution

1. Step 1: Understand Shared VPC concept

   Shared VPC allows multiple projects to connect to a common Virtual Private Cloud network managed by a host project.

2. Step 2: Compare options

   To allow multiple projects to share the same Virtual Private Cloud network correctly describes this sharing of a VPC across projects. Other options describe unrelated features.

3. Final Answer:

   To allow multiple projects to share the same Virtual Private Cloud network -> Option C

4. Quick Check:

   Shared VPC = Shared network across projects [OK]

Hint: Shared VPC means sharing one network across projects [OK]

Common Mistakes:

• Thinking Shared VPC creates isolated networks
• Confusing Shared VPC with backups or internet access
• Assuming Shared VPC is per project only

2. Which of the following is the correct way to enable Shared VPC on a host project using gcloud CLI?

easy

A. gcloud compute shared-vpc enable-host HOST_PROJECT_ID

B. gcloud projects add-iam-policy-binding HOST_PROJECT_ID --member=shared-vpc

C. gcloud compute shared-vpc enable --project=HOST_PROJECT_ID

D. gcloud compute networks create shared-vpc --project=HOST_PROJECT_ID

Solution

1. Step 1: Identify correct gcloud command for enabling Shared VPC

   The command to enable Shared VPC on a host project is 'gcloud compute shared-vpc enable-host'.

2. Step 2: Check options

   gcloud compute shared-vpc enable-host HOST_PROJECT_ID matches the correct syntax. Others are incorrect commands or unrelated.

3. Final Answer:

   gcloud compute shared-vpc enable-host HOST_PROJECT_ID -> Option A

4. Quick Check:

   Enable Shared VPC host with 'enable-host' command [OK]

Hint: Use 'enable-host' to activate Shared VPC on host project [OK]

Common Mistakes:

• Using 'enable' instead of 'enable-host'
• Confusing IAM binding with enabling Shared VPC
• Trying to create a network instead of enabling Shared VPC

3. Given a Shared VPC setup where Project A is the host and Project B is a service project, what happens if a VM in Project B tries to use a subnet from Project A's Shared VPC?

medium

A. The VM can use the subnet and communicate within the Shared VPC network

B. The VM creation fails because subnets cannot be shared

C. The VM uses a default subnet from Project B instead

D. The VM gets an external IP automatically

Solution

1. Step 1: Understand Shared VPC subnet usage

   In Shared VPC, service projects can create resources using subnets from the host project's VPC.

2. Step 2: Analyze VM subnet assignment

   VM in Project B can use Project A's subnet and communicate within the shared network.

3. Final Answer:

   The VM can use the subnet and communicate within the Shared VPC network -> Option A

4. Quick Check:

   Shared VPC allows subnet sharing for VM networking [OK]

Hint: Service projects use host subnets for VM networking [OK]

Common Mistakes:

• Assuming subnets cannot be shared
• Thinking VM defaults to service project subnet
• Confusing external IP assignment with subnet usage

4. You configured a Shared VPC but a service project cannot create VM instances using the host project's subnets. What is the most likely cause?

medium

A. The host project does not have any subnets created

B. The VM instance name is invalid

C. The service project is not linked to the host project

D. The service project lacks the 'compute.networkUser' role on the host project

Solution

1. Step 1: Check permissions for service project

   Service projects need 'compute.networkUser' role on the host project to use its subnets.

2. Step 2: Verify linkage and subnet existence

   While linkage and subnets are important, lack of permission is the most common cause blocking VM creation.

3. Final Answer:

   The service project lacks the 'compute.networkUser' role on the host project -> Option D

4. Quick Check:

   Missing networkUser role blocks subnet use [OK]

Hint: Check 'compute.networkUser' role for service project [OK]

Common Mistakes:

• Ignoring IAM roles and permissions
• Assuming linkage alone is enough
• Blaming VM name instead of network access

5. You want to design a secure environment where multiple teams have their own projects but share a common network with strict firewall rules managed centrally. How does using Shared VPC help achieve this?

hard

A. It requires each team to create their own VPC and manage firewall rules independently

B. It centralizes network management in one host project while teams use service projects for resources

C. It automatically applies firewall rules per project without central control

D. It isolates each team's network completely with no sharing

Solution

1. Step 1: Understand Shared VPC central management

   Shared VPC lets you manage network and firewall rules centrally in a host project.

2. Step 2: Analyze team project usage

   Teams use service projects to create resources but rely on the shared network and firewall rules from the host project.

3. Step 3: Compare options

   It centralizes network management in one host project while teams use service projects for resources correctly describes this central control with resource separation. Other options describe isolation or decentralized management.

4. Final Answer:

   It centralizes network management in one host project while teams use service projects for resources -> Option B

5. Quick Check:

   Shared VPC centralizes network and firewall control [OK]

Hint: Shared VPC centralizes network, teams use separate projects [OK]

Common Mistakes:

• Thinking Shared VPC isolates networks fully
• Assuming firewall rules are per project automatically
• Believing teams manage their own VPCs independently