GCP for DevOps — Advanced Networking Practice Exercises

4 minute read

Advanced Networking Practice Exercises

Exercise 1 — Set Up Cloud DNS

Create a public DNS zone and add A, CNAME, and TXT records.

Steps:

  1. Create a public DNS zone for your domain
  2. Add an A record for www
  3. Add a CNAME for app pointing to Cloud Run
  4. Add a TXT record for verification
Show Answer 
# Create zone
$ gcloud dns managed-zones create my-zone \
    --dns-name="example.com." \
    --visibility=public

# A record
$ gcloud dns record-sets create www.example.com. \
    --zone=my-zone --type=A --ttl=300 \
    --rrdatas="35.201.100.50"

# CNAME to Cloud Run
$ gcloud dns record-sets create app.example.com. \
    --zone=my-zone --type=CNAME --ttl=300 \
    --rrdatas="my-service-abc123.a.run.app."

# TXT record
$ gcloud dns record-sets create example.com. \
    --zone=my-zone --type=TXT --ttl=300 \
    --rrdatas='"google-site-verification=abc123xyz"'

# Verify
$ gcloud dns record-sets list --zone=my-zone

Exercise 2 — Enable Cloud CDN

Enable Cloud CDN on a backend service with static content caching.

Steps:

  1. Create a backend bucket for static files
  2. Enable CDN with appropriate cache settings
  3. Invalidate the cache
Show Answer 
# Create a Cloud Storage bucket for static content
$ gsutil mb -l us-central1 gs://my-static-site

# Upload content
$ echo "<h1>Hello CDN</h1>" > index.html
$ gsutil cp index.html gs://my-static-site/
$ gsutil iam ch allUsers:objectViewer gs://my-static-site

# Create backend bucket with CDN
$ gcloud compute backend-buckets create static-backend \
    --gcs-bucket-name=my-static-site \
    --enable-cdn \
    --default-ttl=3600

# Create URL map
$ gcloud compute url-maps create cdn-lb \
    --default-backend-bucket=static-backend

# Create HTTP proxy and forwarding rule
$ gcloud compute target-http-proxies create cdn-proxy \
    --url-map=cdn-lb

$ gcloud compute forwarding-rules create cdn-frontend \
    --target-http-proxy=cdn-proxy \
    --ports=80 \
    --global

# Invalidate cache after update
$ gsutil cp updated-index.html gs://my-static-site/index.html
$ gcloud compute url-maps invalidate-cdn-cache cdn-lb --path="/*"

Exercise 3 — Cloud Armor WAF Policy

Create a Cloud Armor security policy with SQL injection protection and rate limiting.

Steps:

  1. Create a security policy
  2. Add WAF rules for SQL injection and XSS
  3. Add rate limiting for the login endpoint
  4. Attach to a backend service
Show Answer 
# Create policy
$ gcloud compute security-policies create web-policy \
    --description="Web application firewall"

# Block SQL injection
$ gcloud compute security-policies rules create 1000 \
    --security-policy=web-policy \
    --expression="evaluatePreconfiguredExpr('sqli-v33-stable')" \
    --action=deny-403

# Block XSS
$ gcloud compute security-policies rules create 1100 \
    --security-policy=web-policy \
    --expression="evaluatePreconfiguredExpr('xss-v33-stable')" \
    --action=deny-403

# Rate limit login endpoint
$ gcloud compute security-policies rules create 2000 \
    --security-policy=web-policy \
    --expression="request.path.matches('/login')" \
    --action=rate-based-ban \
    --rate-limit-threshold-count=10 \
    --rate-limit-threshold-interval-sec=60 \
    --ban-duration-sec=300 \
    --conform-action=allow \
    --exceed-action=deny-429 \
    --enforce-on-key=IP

# Attach to backend
$ gcloud compute backend-services update my-backend \
    --global --security-policy=web-policy

# List rules
$ gcloud compute security-policies rules list --security-policy=web-policy

Exercise 4 — Global HTTPS Load Balancer with Managed SSL

Create a Global HTTPS Load Balancer with a managed SSL certificate and path-based routing.

Steps:

  1. Create two backend services (API and static)
  2. Set up URL map with path-based routing
  3. Create a managed SSL certificate
  4. Deploy the full load balancer stack
Show Answer 
# Health check
$ gcloud compute health-checks create http app-hc \
    --port=8080 --request-path=/health

# Backend services
$ gcloud compute backend-services create api-backend \
    --protocol=HTTP --health-checks=app-hc --global
$ gcloud compute backend-services create web-backend \
    --protocol=HTTP --health-checks=app-hc --global

# URL map with path rules
$ gcloud compute url-maps create my-https-lb \
    --default-service=web-backend
$ gcloud compute url-maps add-path-matcher my-https-lb \
    --path-matcher-name=routes \
    --default-service=web-backend \
    --path-rules="/api/*=api-backend"

# Managed SSL certificate
$ gcloud compute ssl-certificates create app-cert \
    --domains="app.example.com" --global

# HTTPS proxy
$ gcloud compute target-https-proxies create https-proxy \
    --url-map=my-https-lb \
    --ssl-certificates=app-cert

# Frontend
$ gcloud compute forwarding-rules create https-frontend \
    --target-https-proxy=https-proxy \
    --ports=443 --global

# HTTP-to-HTTPS redirect
$ gcloud compute url-maps import http-redirect --source=/dev/stdin <<EOF
name: http-redirect
defaultUrlRedirect:
  httpsRedirect: true
  redirectResponseCode: MOVED_PERMANENTLY_DEFAULT
EOF

$ gcloud compute target-http-proxies create http-redirect-proxy \
    --url-map=http-redirect
$ gcloud compute forwarding-rules create http-frontend \
    --target-http-proxy=http-redirect-proxy \
    --ports=80 --global

Exercise 5 — Private Google Access

Enable Private Google Access so VMs without external IPs can access Cloud Storage.

Steps:

  1. Create a VPC with a subnet (no external IPs on VMs)
  2. Enable Private Google Access
  3. Create a VM without an external IP
  4. Verify it can access Cloud Storage
Show Answer 
# Create VPC and subnet
$ gcloud compute networks create private-vpc --subnet-mode=custom
$ gcloud compute networks subnets create private-subnet \
    --network=private-vpc \
    --region=us-central1 \
    --range=10.0.1.0/24

# Enable Private Google Access
$ gcloud compute networks subnets update private-subnet \
    --region=us-central1 \
    --enable-private-ip-google-access

# Create Cloud NAT (for package installation only)
$ gcloud compute routers create nat-router \
    --network=private-vpc --region=us-central1
$ gcloud compute routers nats create nat-config \
    --router=nat-router --region=us-central1 \
    --auto-allocate-nat-external-ips \
    --nat-all-subnet-ip-ranges

# Create VM without external IP
$ gcloud compute instances create private-vm \
    --zone=us-central1-a \
    --machine-type=e2-micro \
    --network=private-vpc \
    --subnet=private-subnet \
    --no-address \
    --scopes=storage-ro

# Create a test bucket
$ gsutil mb gs://pga-test-bucket-$(date +%s)
$ echo "test" | gsutil cp - gs://pga-test-bucket-*/test.txt

# SSH via IAP and test (no external IP needed for IAP)
$ gcloud compute ssh private-vm --zone=us-central1-a --tunnel-through-iap \
    --command="gsutil ls gs://pga-test-bucket-*"
# gs://pga-test-bucket-TIMESTAMP/test.txt

Cleanup

$ gcloud dns managed-zones delete my-zone --quiet
$ gcloud compute backend-buckets delete static-backend --quiet
$ gcloud compute security-policies delete web-policy --quiet
$ gcloud compute forwarding-rules delete https-frontend --global --quiet
$ gcloud compute forwarding-rules delete http-frontend --global --quiet
$ gcloud compute instances delete private-vm --zone=us-central1-a --quiet
$ gcloud compute networks subnets delete private-subnet --region=us-central1 --quiet
$ gcloud compute networks delete private-vpc --quiet

Next Chapter → Security Best Practices

Updated:

You may also enjoy