Examkin

Question

Difficulty: Very hardConfiguring Hybrid Connectivity and VPN Interconnects

An enterprise organization operates two separate Google Cloud Virtual Private Cloud (VPC) networks: vpc-production and vpc-analytics. The vpc-production network is connected to the company's on-premises data center using an High Availability (HA) Cloud VPN gateway paired with a Cloud Router running dynamic BGP routing. The two VPCs are connected using VPC Network Peering with custom route import and export enabled. Network administrators discover that on-premises hosts can successfully reach workloads in vpc-production, but cannot communicate with resources in vpc-analytics. You must enable private on-premises connectivity to both VPC environments without introducing redundant IPSec tunnels or increasing administrative overhead. Which architectural modification should you implement?

  1. Migrate to a Shared VPC architecture by establishing a Host Project containing the HA Cloud VPN and Cloud Router, and attach the analytics workloads as a Service Project within subnets of the Host VPC.Answer
  2. B
    Configure custom route advertisements on the vpc-production Cloud Router to advertise the vpc-analytics subnet IP range to the on-premises BGP peer over the existing VPN session.
  3. C
    Replace the HA Cloud VPN gateway in vpc-production with a Dedicated Interconnect connection and rely on automatic dynamic BGP route propagation between peered VPCs.
  4. D
    Create a VPC Service Controls perimeter containing both vpc-production and vpc-analytics, and configure an ingress rule allowing traffic from on-premises IP blocks.

Answer

Migrate the environment to a Shared VPC architecture where a designated Host Project owns the HA Cloud VPN gateway, Cloud Router, and network subnets, while the analytics workloads reside in an attached Service Project.
Migrating to a Shared VPC architecture resolves the connectivity issue because all subnets belong to the same Host VPC network. The HA Cloud VPN gateway and Cloud Router in the Host VPC can directly route traffic to subnets allocated for service projects (such as analytics), bypassing the non-transitive limitations of VPC Network Peering.

Step-by-Step Solution

1
Analyze why on-premises traffic cannot reach the peered analytics VPC.
Identify that Google Cloud VPC Network Peering is non-transitive, meaning packets arriving from an on-premises hybrid connection (VPN or Interconnect) into one VPC cannot be forwarded across a peering connection to a second VPC.
VPC Network Peering explicitly restricts third-party transitivity for hybrid connectivity resources.
2
Evaluate solutions that consolidate subnets under a single network boundary without multiplying VPN tunnels.
Determine that a Shared VPC topology allows the organization to centralize network infrastructure (HA Cloud VPN, Cloud Router, subnets) in a Host Project.
Shared VPC eliminates the need for peering between internal projects because all service projects share subnets defined in the single Host VPC.
3
Verify traffic routing for service project resources in a Shared VPC.
On-premises routers establish BGP sessions with the Host VPC's Cloud Router, routing traffic directly into subnets used by service project workloads without encountering transitivity barriers.
All traffic flows natively within the same VPC network control plane.

Key Concept

VPC Network Peering Non-Transitivity & Shared VPC Hybrid Routing
Rate this question

Topics

Configuring Hybrid Connectivity and VPN Interconnects

More questions from this topic