VPC Networking Fundamentals Flashcards
How can subnets talk to other subnets in the same VPC?
This is enabled by default and no routes are needed. If the instances cannot talk to either other, there may be a firewall rule blocking it.
How do you configure on-prem private API access?
Use restricted.googleapis.com (199.36.153.4/30) and private.googleapis.com (199.36.153.8/30). Restricted is better because it integrates with VPC service controls. Route traffic over the VPN or interconnect to use this.
How do you list the attributes of custom roles?
gcloud iam roles list –project tbd
Are higher priority values more important or less important?
Less important
What is the difference between a policy based vpn and a route based vpn?
Both are for static routing. Policy based routing: Local IP ranges (left side) and remote IP ranges (right side) are defined as part of the tunnel creation process. Route based VPN: When you create a route based VPN using the GCP Console, you only specify a list of remote IP ranges. Those ranges are only used to create routes in your VPC network to peer resources.
What is a traffic selector?
A traffic selector defines a set of IP address ranges or CIDR blocks used to establish a VPN tunnel
What are the operational metrics for an interconnect link?
network/interconnect/operational says if the interconnect itself is up, and network/interconnect/link/operational tells if an individual circuit is up
What are possible targets of a cloud armor policy?
It only works on HTTP(S) load balancers. Can set IP ranges for allow/deny and can specify a target backend.
What is a network endpoint group (NEG)?
Network endpoint groups (NEGs) are zonal resources that represent collections of IP address and port combinations for GCP resources within a single subnet. Each IP address and port combination is called a network endpoint.
What is a Secondary subnet range?
Secondary range you can apply to a subnet for use with alias IP ranges
Why would you use tags over service accounts for firewall rules?
Don’t need to restart VM to change, can have multiple tags on a VM
Why would you use service accounts over network tags for firewall rules?
Anyone can set any tag! Service accounts are resources with permissions.
What are the IP address ranges you need to assign when you build a GKE cluster?
“Node subnet
Services secondary range
Pods secondary range
Master IP range (for private clusters)”
What is an Ingress controller?
It is a GKE service that creates and manages an HTTP(s) load balancer on GCP. The backend can be a NEG.
