Examkin

Question

Difficulty: HardConfiguring Network Topology and VPC Infrastructure

An enterprise organization is deploying a centralized Shared VPC topology in Google Cloud to connect multiple application service projects with an on-premises environment via Dedicated Interconnect. The architecture must enable a third-party partner organization to securely consume an internal microservice hosted in one of the service projects, while strictly preventing the partner from accessing the on-premises network over the hybrid connection. Additionally, on-premises systems require reliable access to subnets in the service projects. Which TWO network topology configurations should the Cloud Architect implement? (Select TWO.)

  1. Publish the internal microservice using a Private Service Connect (PSC) Service Attachment in the producer VPC and configure consumer endpoints in the partner VPC.Answer
  2. Configure Cloud Routers in the Shared VPC host project to use custom route advertisements for advertising Shared VPC subnet IP ranges to on-premises routers over BGP.Answer
  3. C
    Establish VPC Network Peering between the partner VPC and the Shared VPC host project to allow partner traffic to transit through the host project to the on-premises network.
  4. D
    Deploy High Availability (HA) VPN tunnels instead of Dedicated Interconnect to handle the high-throughput 20 Gbps data traffic requirement between on-premises and Google Cloud.
  5. E
    Rely strictly on Identity and Access Management (IAM) role bindings to restrict data exfiltration across VPC boundaries without configuring VPC Service Controls or private endpoints.

Answer

The optimal configuration involves publishing the service using Private Service Connect service attachments for partner access and configuring Cloud Router custom route advertisements in the Shared VPC host project for hybrid connectivity.
Publishing the internal microservice via Private Service Connect allows the partner organization to privately reach the application endpoint using IP addresses in their own VPC, preventing any direct network peering or access to the on-premises Interconnect. Concurrently, configuring custom route advertisements on Cloud Routers in the Shared VPC host project ensures that on-premises devices receive BGP routes to all subnets across the host and service projects.

Step-by-Step Solution

1
Analyze partner service access requirement without transit risk
Private Service Connect allows unidirectional, service-level private access across organization boundaries without creating transitive network paths to on-premises environments.
VPC Peering would fail due to non-transitivity and would expose broader network visibility than intended.
2
Configure dynamic hybrid routing for Shared VPC subnets
Cloud Routers established in the host project advertise subnets belonging to service projects using BGP custom route advertisements.
On-premises routers require explicit BGP advertisements to route traffic directly to GCP service subnets over Dedicated Interconnect.

Key Concept

Shared VPC hybrid routing with Dedicated Interconnect and Private Service Connect service publishing
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic