Examkin

Question

Difficulty: MediumDesigning Network Architecture and Hybrid Connectivity

A financial enterprise is designing a hybrid cloud network connecting its primary on-premises facility to two Google Cloud regions (us-east1 and us-west1). The architecture requires resilient, fault-tolerant routing between on-premises and GCP, private access to Google APIs from cloud workloads, and connectivity to a third-party partner's VPC peered with the central hub VPC. Which TWO architectural decisions must be implemented to fulfill these requirements correctly? (Select TWO)

  1. Configure Cloud Router with Global Dynamic Routing enabled to dynamically exchange BGP routes across all regions between the on-premises network and GCP.Answer
  2. Establish Private Google Access or Private Service Connect endpoints within the subnets to allow internal resources to reach Google APIs securely without public IP addresses.Answer
  3. C
    Rely on the central hub VPC's Cloud Router to transitively route traffic from the on-premises network to the third-party partner VPC through the existing VPC Network Peering connection.
  4. D
    Deploy a single Classic Cloud VPN tunnel with static routes to achieve 15 Gbps aggregated throughput and a guaranteed 99.99% availability SLA for high-volume data transfers.

Answer

The two correct choices are to enable Global Dynamic Routing on Cloud Router for multi-region BGP route exchange, and to configure Private Google Access/Private Service Connect for secure internal API connectivity.
Global Dynamic Routing on Cloud Router provides multi-region BGP route exchange across all VPC subnets, and Private Google Access ensures cloud resources communicate with Google APIs over internal GCP infrastructure without public IP exposure.

Step-by-Step Solution

1
Evaluate hybrid multi-region routing requirements.
Enabling Global Dynamic Routing allows Cloud Routers in any region to dynamically learn and propagate BGP routes across all subnets in all regions within the VPC.
Regional dynamic routing restricts route learning to the local region, whereas multi-region hybrid topologies require global route propagation.
2
Evaluate private API access requirements.
Private Google Access or Private Service Connect enables internal IP compute instances to securely communicate with Google APIs.
This prevents sensitive cloud application traffic from routing over public IP addresses.
3
Evaluate VPC Network Peering transitive routing limits.
Identify that VPC Network Peering does not extend on-premises hybrid connections to peered VPCs automatically.
VPC Peering is strictly non-transitive, so on-premises traffic cannot traverse a peering connection into a third VPC.

Key Concept

Multi-region hybrid network routing with Cloud Router and VPC Network Peering non-transitivity constraints
Rate this question

Topics

Designing Network Architecture and Hybrid Connectivity