Google Professional Cloud Network Engineer Question 224
Select 3Google Cloud PlatformYou are a network engineer at an organization that uses Google Cloud. You are tasked with creating a Shared VPC in the host project 'central-network' and sharing a subnet with two service projects: 'dev-project' and 'prod-project'. Which of the following steps are required to allow the service projects to use the shared subnet?
- A
Enable the Shared VPC Host feature in the 'central-network' project.
- B
Grant the 'Network User' IAM role for the shared subnet to the 'dev-project' and 'prod-project' service accounts.
- C
Create the shared subnet in the 'dev-project' and 'prod-project' projects.
- D
Add the 'dev-project' and 'prod-project' as service projects to the Shared VPC host project.
- E
Grant the 'Compute Admin' IAM role to all users in the 'dev-project' and 'prod-project'.
Show answer and explanation
Correct answers: A, B, D
Explanation
To successfully share a subnet using a Shared VPC, the host project must first enable the Shared VPC Host feature. The 'Network User' IAM role should then be granted to the service projects for the specific subnet. Additionally, the service projects must be explicitly added to the Shared VPC host project. Subnets are created in the host project and shared with service projects, not the other way around. Granting roles like 'Compute Admin' to all users in the service projects is neither secure nor required for this setup.
- A. Correct.
Correct. Enabling the Shared VPC Host feature in the 'central-network' project is a fundamental step, as it designates the project as a Shared VPC host.
- B. Correct.
Correct. Granting the 'Network User' IAM role to the service projects ensures they can use the shared subnet within the Shared VPC host project.
- C. Incorrect.
Incorrect. Shared subnets are created in the host project ('central-network'), not in the service projects.
- D. Correct.
Correct. Adding service projects to the Shared VPC host project is essential to allow them to access the shared resources.
- E. Incorrect.
Incorrect. Granting the 'Compute Admin' role is unnecessary for this purpose and would give excessive permissions beyond what is required for using the Shared VPC.