Examkin

Question

Difficulty: HardConfiguring Network Topology and VPC Infrastructure

An enterprise organization has established a hub-and-spoke network topology in Google Cloud using VPC Network Peering to connect a central Operations VPC (Hub) with two isolated workload environments: Production VPC (Spoke 1) and Staging VPC (Spoke 2). Virtual machines in both workload VPCs can successfully communicate with shared management utilities inside the Operations VPC. However, virtual machines in the Production VPC are unable to reach virtual machines in the Staging VPC. The architecture team mandates establishing direct, private internal IP connectivity between the Production VPC and Staging VPC while preserving sub-millisecond latency and avoiding public exposure or transit costs. Which architectural change should the Cloud Architect implement to satisfy this requirement?

  1. A
    Configure custom route exchange on the existing VPC Network Peering connections to allow transit routing through the Operations VPC.
  2. Establish a direct VPC Network Peering connection between the Production VPC and the Staging VPC.Answer
  3. C
    Deploy HA VPN gateways between the workload VPCs and the Operations VPC, relying on Cloud Router dynamic route advertising over Dedicated Interconnect.
  4. D
    Create a VPC Service Controls perimeter encompassing all three VPCs and configure ingress and egress rules to route traffic through the Hub.

Answer

Establish a direct VPC Network Peering connection between the Production VPC and the Staging VPC.
Google Cloud VPC Network Peering is inherently non-transitive. If VPC A is peered to VPC B, and VPC B is peered to VPC C, VPC A cannot reach VPC C through VPC B. To enable direct private communication between two spoke VPCs, a direct VPC Network Peering connection must be created explicitly between those two spoke networks.

Step-by-Step Solution

1
Analyze the existing connectivity model and restriction.
The current topology relies on VPC Network Peering between a central Hub network and two spoke networks (Spoke 1 and Spoke 2). Spoke 1 can communicate with Hub, and Spoke 2 can communicate with Hub.
VPC Network Peering in Google Cloud is strictly non-transitive by design.
2
Evaluate why transit routing through the Hub fails.
Traffic from Spoke 1 directed to Spoke 2 cannot cross the Hub VPC because peered routes from Spoke 2 are not re-advertised or forwarded to Spoke 1 through the Hub.
Google Cloud network architecture enforces non-transitivity to prevent unintentional route propagation across peered VPC boundaries.
3
Determine the optimal solution meeting private connectivity, low latency, and non-public IP requirements.
Establishing a direct VPC Network Peering link between Production VPC and Staging VPC establishes direct internal IP routing between them without intermediate gateway overhead.
Direct peering connects the two networks at the Virtual Network stack level, providing low-latency, full-bandwidth private internal communication.

Key Concept

Non-transitivity of Google Cloud VPC Network Peering
Estimated Time:2m 0s
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic