Examkin

Question

Difficulty: MediumConfiguring Network Topology and VPC Infrastructure

An organization is deploying two separate workload networks: a Staging VPC and a Production VPC. Both VPCs require private communication with a central Shared VPC that hosts shared services and maintains a Cloud VPN connection to an on-premises data center. To maintain compliance, network traffic between the Staging VPC and Production VPC must be strictly blocked, and direct IP routing between them must not exist. Which TWO network topology configurations should you implement to satisfy these requirements? (Select TWO.)

  1. Establish a VPC Network Peering connection between the Staging VPC and the Shared VPC, and a separate VPC Network Peering connection between the Production VPC and the Shared VPC.Answer
  2. B
    Establish a VPC Network Peering mesh connecting Staging, Production, and Shared VPCs, relying on firewall rules to deny traffic between Staging and Production.
  3. Configure the VPC Peering connections to export custom routes from the Shared VPC and import custom routes into the Staging and Production VPCs.Answer
  4. D
    Provision dedicated Cloud VPN tunnels directly between the Staging VPC and Production VPC, using Cloud Router to filter invalid subnet routes.
  5. E
    Configure VPC Service Controls to automatically bridge the layer 3 routing tables between the Staging VPC and Production VPC.

Answer

To connect Staging and Production VPCs to shared resources and on-premises networks while keeping them completely isolated from each other, configure separate VPC Network Peering connections from each spoke VPC to the Shared VPC, and enable custom route import/export on those peering connections.
The solution leverages the non-transitive property of GCP VPC Network Peering. Peering each spoke VPC individually to the Shared VPC permits communication with central resources while guaranteeing that traffic cannot transit between the Staging and Production VPCs. Additionally, enabling custom route import and export on the peering connections allows dynamic routes learned from the central Cloud VPN connection to be propagated to both spoke VPCs.

Step-by-Step Solution

1
Evaluate network isolation requirements between Staging and Production VPCs.
Confirm that direct routing between Staging and Production must be absent.
VPC Network Peering does not support transitive routing. If Spoke A is peered to Hub, and Spoke B is peered to Hub, Spoke A cannot reach Spoke B through the Hub VPC unless explicitly connected.
2
Design hub-and-spoke peering connections.
Peer Staging VPC to Shared VPC, and Production VPC to Shared VPC.
This grants both spokes access to the Shared VPC while leveraging non-transitivity to block inter-spoke routing.
3
Enable hybrid route propagation across peering boundaries.
Configure import and export of custom routes on both VPC peering connections.
By default, peering connections do not exchange dynamic routes learned from Cloud VPN/Interconnect. Enabling custom route exchange allows spokes to learn on-premises routes via the Shared VPC's Cloud Router.

Key Concept

Hub-and-spoke VPC topology using non-transitive VPC Network Peering and custom route exchange
Estimated Time:2m 0s
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic