Google Professional Cloud Network Engineer Question 222
Select 3Google Cloud PlatformYou are a Google Cloud Network Engineer responsible for creating a Shared VPC to centralize network resources for your organization. You need to share specific subnets from a host project with multiple service projects while ensuring proper permissions. Which of the following steps must be taken to achieve this setup?
- A
Enable the Shared VPC feature in the host project.
- B
Grant the 'Shared VPC Admin' IAM role to users in the service projects.
- C
Associate the service projects with the host project as service projects.
- D
Assign the 'Compute Network User' IAM role for the shared subnets to appropriate service project users.
- E
Create a VPC network in each service project to connect to the shared subnets.
Show answer and explanation
Correct answers: A, C, D
Explanation
To configure a Shared VPC, you first enable the Shared VPC feature in the host project. Service projects must be associated with the host project, and users in the service projects need the 'Compute Network User' IAM role on the shared subnets to utilize them. The 'Shared VPC Admin' role is typically used for centralized management of Shared VPC in the host project, and creating separate VPC networks in service projects is unnecessary as they utilize the host project's network.
- A. Correct.
Enabling the Shared VPC feature in the host project is the first step to configure Shared VPC. Without this, no subnets can be shared with service projects.
- B. Incorrect.
The 'Shared VPC Admin' role is needed for managing Shared VPC configurations, but this role is typically assigned at the host project level, not to users in service projects.
- C. Correct.
Service projects must be explicitly associated with the host project to enable access to the shared subnets.
- D. Correct.
The 'Compute Network User' IAM role must be granted to users or service accounts in the service projects to allow them to use the shared subnets.
- E. Incorrect.
Creating a VPC network in each service project is not required, as the service projects will use the shared VPC network from the host project.