Your enterprise organization has two Virtual Private Cloud (VPC) networks, `shared-services-vpc` and `application-vpc`, in the same Google Cloud project. You are deploying an Internal HTTP(S) Load Balancer in `application-vpc` to expose a microservice, and you need clients in both VPC networks to resolve the load balancer's internal IP address using a private DNS domain name (`internal.example.com`). Which of the following configuration steps are required to successfully deploy this solution? (Select TWO choices.)
- Authorize both `application-vpc` and `shared-services-vpc` in the Cloud DNS private zone network visibility settings.Answer
- Reserve and allocate a dedicated proxy-only subnet in the region where the Internal HTTP(S) Load Balancer is deployed.Answer
- CEnable the Cloud DNS API directly at the GCP Organization resource level to permit cross-VPC DNS resolution.
- DApply IAM roles at the subnet level to override the default organization policy hierarchy for cross-VPC traffic.
Answer
To successfully allow private DNS resolution across multiple VPCs and deploy an Internal HTTP(S) Load Balancer, you must authorize both VPC networks in the Cloud DNS private zone settings and create a regional proxy-only subnet for the load balancer's Envoy proxies.
Authorizing both VPC networks in the Cloud DNS private zone configuration ensures that VMs in both networks can query and resolve internal DNS records. Creating a regional proxy-only subnet is a strict prerequisite for deploying an Internal HTTP(S) Load Balancer because Envoy proxies require IP addresses allocated from this dedicated subnet to forward requests to backend services.
Step-by-Step Solution
Key Concept
Cloud DNS Private Zone Authorization and Internal HTTP(S) Load Balancing Subnet Requirements