Examkin

Question

Difficulty: MediumManaging Networking Resources

An organization is configuring VPC Network Peering to connect two Virtual Private Cloud (VPC) networks, `prod-vpc` and `shared-services-vpc`, across different projects in Google Cloud. Which of the following statements regarding VPC Network Peering behavior and operational requirements are correct?

  1. The VPC Network Peering connection must be created in both directions—from `prod-vpc` to `shared-services-vpc` and from `shared-services-vpc` to `prod-vpc`—before communication between the networks is established.Answer
  2. Transitive peering is not supported; traffic cannot route from `prod-vpc` through `shared-services-vpc` to reach a third peered network without a direct peering connection.Answer
  3. C
    Peered VPC networks can successfully establish a peering relationship even if their primary IPv4 subnet CIDR ranges overlap, provided custom static routes are configured.
  4. D
    Firewall rules defined in `shared-services-vpc` automatically extend to protect instances in `prod-vpc` once peering is ACTIVE.

Answer

The two correct statements are that VPC Network Peering must be configured in both directions to become active, and that transitive peering is not supported in Google Cloud VPC networks.
VPC Network Peering requires both sides to establish a peering configuration to move the connection state to ACTIVE. Additionally, peering is non-transitive, meaning traffic cannot hop through a peered network to reach a third network.

Step-by-Step Solution

1
Analyze peering creation workflow requirement
Determine that both network administrators must initiate peering for the state to transition to ACTIVE.
Google Cloud enforces explicit bidirectional peering configuration to prevent unauthorized network access.
2
Evaluate network transitivity rules
Confirm that intermediate network routing across peered networks is blocked.
VPC Network Peering strictly limits reachability exclusively to direct peers.
3
Examine subnet CIDR overlap constraints
Identify that overlapping subnet IP ranges prevent peering initialization.
Google Cloud VPC validation prevents peering setup when IP address space conflicts exist.
4
Examine firewall rule enforcement scope
Verify that firewall rules are enforced per-VPC and never exported.
Each VPC network maintains its own distinct security boundary and firewall configuration.

Key Concept

VPC Network Peering capabilities and configuration constraints
Rate this question

Topics

Managing Networking Resources

More questions from this topic