Why advanced networking matters in GCP - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why use Virtual Private Cloud (VPC) in GCP?

Which of the following best explains why Virtual Private Cloud (VPC) is important in Google Cloud Platform networking?

A VPC provides a graphical interface to manage billing and user accounts.

B VPC is a storage service that backs up your data across regions.

C VPC allows you to isolate your cloud resources in a private network, controlling traffic and improving security.

D VPC automatically scales your compute instances without any configuration.

💡 Hint

Think about how you keep your home safe and private from strangers.

A Virtual Private Cloud (VPC) creates a private network in the cloud where you can place your resources securely. It controls how data moves in and out, just like a fence around your house.

❓ service_behavior

intermediate

What happens when you enable Private Google Access?

In GCP, what is the effect of enabling Private Google Access on a subnet?

A Instances without external IPs can access Google APIs and services privately without using the public internet.

B Instances can only communicate within the subnet and cannot reach any external services.

C All traffic from the subnet is blocked from accessing Google services.

D Instances gain automatic public IP addresses for internet access.

💡 Hint

Think about how you might access a service inside your home network without going outside.

Private Google Access allows instances without public IPs to reach Google APIs and services through Google's private network, avoiding the public internet.

❓ Architecture

advanced

Designing a multi-region VPC network

You want to design a VPC network that spans multiple GCP regions to support a global application with low latency and high availability. Which architecture best achieves this?

A Create a single global VPC with subnets in each region and use Cloud VPN or Cloud Interconnect to connect on-premises networks.

B Create separate VPCs in each region and connect them using VPC peering to allow internal communication.

C Use only one region with a large subnet and rely on global load balancing to serve all users.

D Create multiple VPCs in each region without any peering or interconnection.

💡 Hint

Think about how a single network can cover many locations while staying connected.

A global VPC with subnets in multiple regions allows resources to communicate securely and efficiently. Cloud VPN or Interconnect connects on-premises networks to this global VPC.

❓ security

advanced

Securing GCP workloads with firewall rules

Which firewall rule configuration best restricts access to a GCP VM instance to only trusted IP addresses?

A Create an ingress firewall rule allowing traffic from any IP address on all ports.

B Create an egress firewall rule allowing traffic to all IP addresses.

C Disable all firewall rules to avoid conflicts.

D Create an ingress firewall rule allowing traffic only from the trusted IP ranges and deny all other ingress traffic.

💡 Hint

Think about locking your front door and only letting in people you know.

Ingress firewall rules control incoming traffic. Allowing only trusted IP ranges and denying others protects the VM from unwanted access.

✅ Best Practice

expert

Optimizing network performance with Cloud CDN and Load Balancing

You have a global web application hosted on GCP. To reduce latency and improve user experience worldwide, which combination of services should you use?

A Use only regional Load Balancers without caching to keep traffic local.

B Use Cloud CDN with a global HTTP(S) Load Balancer to cache content at edge locations and distribute traffic efficiently.

C Use Cloud VPN to connect all users directly to the backend instances.

D Use Cloud Storage buckets in a single region to serve all content.

💡 Hint

Think about how a popular website serves content quickly to users everywhere.

Cloud CDN caches content close to users at edge locations, while a global HTTP(S) Load Balancer routes traffic efficiently to backend instances, reducing latency.

Practice

1. Why is advanced networking important in Google Cloud Platform (GCP)?

easy

A. It helps connect cloud resources securely and efficiently.

B. It automatically fixes all software bugs.

C. It increases the size of virtual machines.

D. It reduces the cost of cloud storage.

Solution

1. Step 1: Understand the role of networking in cloud

   Networking connects different cloud resources so they can communicate.

2. Step 2: Recognize the benefits of advanced networking

   Advanced networking adds security and efficiency to these connections.

3. Final Answer:

   It helps connect cloud resources securely and efficiently. -> Option A

4. Quick Check:

   Advanced networking = secure, efficient connections [OK]

Hint: Think about how cloud parts talk safely and fast [OK]

Common Mistakes:

• Confusing networking with software debugging
• Mixing networking with storage or VM sizing
• Assuming networking reduces costs directly

2. Which of the following is the correct way to create a custom VPC network in GCP using gcloud CLI?

easy

A. gcloud compute networks new my-network --subnet-mode=auto

B. gcloud compute networks create my-network --subnet-mode=custom

C. gcloud network create my-network --subnet=custom

D. gcloud compute create network my-network --mode=auto

Solution

1. Step 1: Recall gcloud command syntax for creating networks

   The correct command uses 'gcloud compute networks create' with '--subnet-mode=custom' to specify custom subnets.

2. Step 2: Check each option for correct syntax

   gcloud compute networks create my-network --subnet-mode=custom matches the correct syntax; others have wrong commands or flags.

3. Final Answer:

   gcloud compute networks create my-network --subnet-mode=custom -> Option B

4. Quick Check:

   Correct gcloud network create syntax = gcloud compute networks create my-network --subnet-mode=custom [OK]

Hint: Remember 'gcloud compute networks create' plus subnet mode [OK]

Common Mistakes:

• Using 'create network' instead of 'networks create'
• Mixing 'subnet-mode' with wrong flags
• Using 'new' instead of 'create'

3. Given this firewall rule configuration in GCP, what will happen if you try to connect to a VM on port 22 (SSH)?

gcloud compute firewall-rules create allow-ssh --network=my-network --allow=tcp:22 --source-ranges=10.0.0.0/24

medium

A. SSH connections from IPs outside 10.0.0.0/24 will be blocked.

B. SSH connections from any IP address will be allowed.

C. All traffic to port 22 will be blocked.

D. SSH connections from 0.0.0.0/0 will be allowed.

Solution

1. Step 1: Analyze the firewall rule source range

   The rule allows TCP port 22 only from IPs in 10.0.0.0/24 subnet.

2. Step 2: Understand effect on SSH connections

   SSH from IPs outside 10.0.0.0/24 will be blocked because no rule allows them.

3. Final Answer:

   SSH connections from IPs outside 10.0.0.0/24 will be blocked. -> Option A

4. Quick Check:

   Firewall source range limits access = SSH connections from IPs outside 10.0.0.0/24 will be blocked. [OK]

Hint: Check source-ranges to see who can connect [OK]

Common Mistakes:

• Assuming all IPs can connect
• Confusing source-ranges with destination
• Ignoring firewall rule specificity

4. You created a custom subnet in GCP but your VM instances cannot reach the internet. What is the most likely cause?

medium

A. The VM instances have static internal IPs.

B. Firewall rules allow all outbound traffic.

C. The subnet is set to auto mode.

D. No Cloud NAT or external IP assigned to the VM instances.

Solution

1. Step 1: Understand internet access requirements

   VMs in custom subnets need either external IPs or Cloud NAT to access the internet.

2. Step 2: Identify missing component

   If VMs lack external IPs and no Cloud NAT is configured, they cannot reach the internet.

3. Final Answer:

   No Cloud NAT or external IP assigned to the VM instances. -> Option D

4. Quick Check:

   Internet access needs NAT or external IP [OK]

Hint: Check if VMs have external IP or Cloud NAT [OK]

Common Mistakes:

• Assuming firewall rules block outbound by default
• Confusing auto and custom subnet modes
• Thinking static internal IPs block internet

5. You want to design a GCP network architecture that isolates sensitive workloads but allows secure communication between them and public-facing services. Which advanced networking features should you combine?

hard

A. Assign public IPs to all VMs and disable firewall rules.

B. Use a single auto mode VPC with no firewall rules.

C. Use separate custom VPCs with VPC peering and firewall rules to control traffic.

D. Use default network and rely on default firewall rules.

Solution

1. Step 1: Identify isolation and secure communication needs

   Separate VPCs isolate workloads; VPC peering allows controlled communication.

2. Step 2: Apply firewall rules for traffic control

   Firewall rules restrict and allow only needed traffic between workloads and public services.

3. Final Answer:

   Use separate custom VPCs with VPC peering and firewall rules to control traffic. -> Option C

4. Quick Check:

   Isolation + secure communication = VPC peering + firewall [OK]

Hint: Combine VPC peering and firewall rules for isolation and access [OK]

Common Mistakes:

• Using auto mode VPCs without control
• Assigning public IPs to sensitive workloads
• Relying on default network without customization