Examkin

Question

Difficulty: MediumConfiguring Network Topology and VPC Infrastructure

A multinational enterprise is designing a hub-and-spoke VPC architecture in Google Cloud. The central hub VPC is connected to an on-premises data center via a 10 Gbps Cloud Interconnect. Two spoke VPCs (Analytics VPC and Production VPC) are connected to the central hub VPC using VPC Network Peering. On-premises workloads require direct connectivity to resources inside the spoke VPCs, and workloads in the spoke VPCs must privately reach Google Cloud APIs (such as Cloud Storage and BigQuery) without routing traffic through the public internet. Which TWO network topology configurations must be implemented to fulfill these requirements?

  1. Configure custom route export and import flags on the VPC Network Peering connections between the hub and spoke VPCs, and set up custom BGP route advertisements on the hub Cloud Router to announce spoke subnets to on-premises.Answer
  2. Enable Private Google Access on the subnets inside the spoke VPCs and deploy Private Service Connect (PSC) endpoints inside the VPCs to allow private access to Google APIs from both GCP workloads and on-premises systems.Answer
  3. C
    Rely on standard VPC Network Peering automatic routing, as VPC Peering inherently routes traffic transitively from on-premises Cloud Interconnect gateways through the hub VPC into spoke VPCs without additional BGP configuration.
  4. D
    Replace the Dedicated Interconnect with multiple HA VPN tunnels operating in dynamic routing mode to achieve higher aggregate bandwidth and simplify transitive spoke routing.
  5. E
    Provision private GKE clusters in the spoke VPCs and leave the control plane public endpoint unconstrained so that on-premises administrative tools can connect without configuring authorized networks.

Answer

The correct configurations are exporting/importing custom routes on VPC Peering connections along with custom BGP route advertisements on the hub Cloud Router, and enabling Private Google Access on spoke subnets with Private Service Connect endpoints.
To establish end-to-end connectivity between on-premises networks and spoke VPCs in a hub-and-spoke model, custom route export and import must be enabled on VPC Peering links, and the hub Cloud Router must use custom BGP announcements to advertise spoke CIDRs to on-premises. Additionally, Private Google Access and Private Service Connect endpoints grant private internal access to Google APIs without traversing public IP space.

Step-by-Step Solution

1
Address hybrid reachability across non-transitive VPC Peering boundaries.
Enable custom route exchange on VPC Peering and configure BGP custom route advertisements on the hub VPC Cloud Router.
VPC Network Peering is non-transitive. On-premises routers connected via Cloud Interconnect will not automatically learn spoke VPC routes unless custom routes are exported/imported across peering and advertised via BGP on the Cloud Router.
2
Configure private Google API access for spoke VPC workloads and on-premises hosts.
Enable Private Google Access on spoke subnets and set up Private Service Connect (PSC) endpoints.
Private Google Access provides internal routing to Google API endpoints for subnet VMs without external IPs. Private Service Connect endpoints assign internal IP addresses to Google services, enabling both VPC workloads and on-premises networks to reach APIs securely.

Key Concept

Hub-and-spoke VPC topology design, custom BGP route propagation across VPC Peering, and Private Service Connect deployment.
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic