Examkin

Question

Difficulty: Very hardConfiguring Hybrid Connectivity and VPN Interconnects

An enterprise financial organization is migrating mission-critical systems to Google Cloud. The solution requires a hybrid connectivity architecture between their primary on-premises data center and a multi-region Google Cloud VPC network. The design must satisfy three mandatory requirements:
1. Maintain a SLA-backed availability SLA of 99.99% for hybrid connectivity.
2. Ensure all data in transit across the hybrid connection is encrypted using IPsec.
3. Provide sustained aggregate encrypted throughput exceeding 20 Gbps.

How should the Principal Cloud Architect design and provision this hybrid connectivity architecture to satisfy all requirements?

  1. Provision a 99.99% HA Dedicated Interconnect deployment across two distinct metropolitan locations with four total VLAN attachments, and configure HA VPN over Private IP across the interconnect attachments with multiple scaled IPsec tunnels.Answer
  2. B
    Provision multiple multi-region HA VPN gateways operating directly over public internet connections with eight active IPsec tunnels managed by regional Cloud Routers.
  3. C
    Deploy a 99.99% HA Dedicated Interconnect topology terminating in a central Hub VPC, relying on VPC Network Peering to transit unencrypted on-premises traffic to multiple spoke VPCs.
  4. D
    Provision a 99.99% HA Partner Interconnect topology and configure VPC Service Controls perimeter policies on the interconnect subnets to handle layer 3 payload IPsec encryption.

Answer

Deploy a 99.99% HA Dedicated Interconnect architecture across two metropolitan locations with four VLAN attachments, and establish HA VPN over Private IP across those attachments.
To achieve a 99.99% availability SLA on Google Cloud hybrid connectivity alongside IPsec transit encryption and >20 Gbps throughput, the architecture must combine 99.99% HA Dedicated Interconnect (4 VLAN attachments across 2 metros and 2 regions) with HA VPN over Private IP. This setup uses Dedicated Interconnect links to transport IPsec-encrypted private traffic while delivering high availability and deterministic performance.

Step-by-Step Solution

1
Analyze availability and SLA requirements
Determined that achieving a 99.99% SLA requires Dedicated Interconnect provisioned across two distinct edge availability domains (metropolitan locations) with at least 4 total VLAN attachments connected to Cloud Routers in two GCP regions.
Google Cloud guarantees 99.99% availability for Dedicated Interconnect only when deployed across dual metros and dual regions.
2
Evaluate bandwidth and transit encryption requirements
Identified HA VPN over Private IP (HA VPN over Cloud Interconnect) as the required architecture to combine IPsec encryption with high-capacity Dedicated Interconnect capacity.
Standard IPsec VPN over public internet cannot guarantee high-throughput SLAs, whereas HA VPN running over Private IP on Dedicated Interconnect provides encrypted transit at scale over dedicated links.
3
Validate BGP dynamic routing and tunnel scaling
Configured multiple HA VPN tunnels over the private IP attachments using Cloud Routers with dynamic BGP to scale past individual tunnel limits and achieve over 20 Gbps aggregate throughput.
Multiple private IP VPN tunnels load balanced with ECMP BGP routing deliver the necessary aggregate throughput while keeping all traffic encrypted.

Key Concept

HA VPN over Dedicated Interconnect (Private IP IPsec Encryption with 99.99% SLA Topology)
Rate this question

Topics

Configuring Hybrid Connectivity and VPN Interconnects

More questions from this topic