Examkin

Question

Difficulty: HardDesigning Network Architecture and Hybrid Connectivity

An international media production studio is designing a hybrid network architecture on Google Cloud. The team connected their primary on-premises data center to a central Hub VPC network using Dedicated Interconnect. To isolate environments for separate project teams, they created standalone VPC networks for a Rendering workload and an Asset Storage workload, connecting both to the Hub VPC using VPC Network Peering. On-premises workstations must communicate directly with resources in both the Rendering and Asset Storage VPCs, but network testing shows traffic from on-premises cannot reach either peered VPC. How should you redesign the network architecture to enable full on-premises connectivity to all workloads while minimizing operational overhead?

  1. Migrate the cloud footprint to a Shared VPC architecture where a Host Project contains the Dedicated Interconnect and shares subnets with Service Projects hosting the Rendering and Asset Storage workloads.Answer
  2. B
    Enable custom route exchange on all existing VPC Network Peering connections between the Hub VPC and the spoke VPC networks.
  3. C
    Replace the Dedicated Interconnect with Classic Cloud VPN gateways deployed directly inside each individual spoke VPC network.
  4. D
    Configure static routes in the Hub VPC specifying the Cloud Interconnect VLAN attachment as the next hop for the spoke VPC IP ranges.

Answer

Migrate the cloud footprint to a Shared VPC architecture where a Host Project contains the Dedicated Interconnect and shares subnets with Service Projects hosting the Rendering and Asset Storage workloads.
Migrating to a Shared VPC architecture consolidates network infrastructure into a single Host Project while keeping application workloads isolated inside Service Projects. Because all subnets exist natively within the same Shared VPC network, the Dedicated Interconnect connection in the Host Project provides direct IP reachability to all workloads without violating transitive routing restrictions.

Step-by-Step Solution

1
Analyze the connectivity issue and network constraint.
Identified that traffic from on-premises over Dedicated Interconnect cannot reach the Rendering and Asset Storage VPCs because VPC Network Peering does not support transitive routing.
Google Cloud VPC Network Peering strictly limits route propagation to directly peered VPC networks; external routes learned via Cloud Router over Dedicated Interconnect are not advertised across peer boundaries to additional spokes.
2
Evaluate GCP networking patterns for hybrid connectivity across multiple projects.
Determined that Shared VPC allows centralized network management, where a Host Project owns the VPC network, subnets, and Cloud Interconnect attachments, while Service Projects isolate compute resources.
By placing all subnets within a single Shared VPC network across projects, on-premises traffic arriving via Dedicated Interconnect can reach all subnets directly without traversing a peering hop.
3
Select the optimal architectural solution.
Adopted Shared VPC with Dedicated Interconnect provisioned in the Host Project.
This design satisfies high-throughput hybrid connectivity requirements, eliminates the non-transitive routing barrier, and maintains environment separation with minimal management overhead.

Key Concept

VPC Network Peering Non-Transitivity vs Shared VPC Architecture
Rate this question

Topics

Designing Network Architecture and Hybrid Connectivity