Examkin

Question

Difficulty: Very hardConfiguring Network Topology and VPC Infrastructure

An enterprise organization is deploying a hub-and-spoke Virtual Private Cloud (VPC) topology on Google Cloud. The central Hub VPC connects to an on-premises data center using Dedicated Interconnect with Cloud Router. Separate spoke VPCs host Production and Staging workloads. The lead architect must enforce the following networking requirements:
1. Spoke VPCs must securely communicate with services in the Hub VPC and access on-premises resources via the Dedicated Interconnect.
2. Spoke VPCs must remain strictly isolated from one another without direct or inter-spoke transit path communication.
3. Workloads in spoke VPCs must reach Google Cloud APIs and private Google Kubernetes Engine (GKE) control planes securely without assigning public IP addresses or exposing master endpoints to the public internet.

Which TWO configuration actions should the Cloud Architect implement to satisfy these architecture requirements? (Select TWO.)

  1. Establish VPC Network Peering between each spoke VPC and the Hub VPC, enabling custom route export on the Hub peering and custom route import on the spoke peerings.Answer
  2. B
    Configure Cloud Router in the Hub VPC with transitive BGP route reflection enabled so that spoke VPC peering connections automatically forward traffic between spoke VPCs.
  3. C
    Replace Dedicated Interconnect with individual High Availability (HA) IPsec VPN tunnels between each spoke VPC and the on-premises environment to bypass VPC Peering bandwidth limitations.
  4. Enable Private Google Access on subnets within spoke VPCs and configure Authorized Networks for private GKE cluster control plane endpoints using internal IP ranges.Answer
  5. E
    Disable control plane authorized networks on private GKE clusters and assign public IP endpoints to master nodes to facilitate administrative routing across the Dedicated Interconnect.

Answer

The correct architecture requires establishing VPC Network Peering between each spoke and the Hub VPC with custom route import/export enabled to exchange dynamic routes with Dedicated Interconnect, and enabling Private Google Access along with GKE control plane authorized networks using internal IP ranges.
Establishing VPC Network Peering between each spoke and the Hub VPC ensures that spoke workloads can reach central resources while remaining strictly isolated from each other, because VPC Network Peering is non-transitive by design. Enabling custom route export on the Hub peering and custom route import on the spoke peerings allows dynamic routes learned via BGP on the Dedicated Interconnect Cloud Router to propagate into the spoke routing tables. Additionally, enabling Private Google Access on spoke subnets allows private instances to reach Google APIs, while configuring GKE control plane authorized networks with internal IP ranges ensures secure management access without internet exposure.

Step-by-Step Solution

1
Analyze spoke-to-hub and inter-spoke network isolation requirements.
Identify that VPC Network Peering provides non-transitive regional and global routing, ensuring Hub-to-spoke connectivity while preventing spoke-to-spoke communication.
VPC Network Peering naturally prevents inter-spoke transit traffic, fulfilling the security boundary requirement between Production and Staging.
2
Configure hybrid route propagation from Dedicated Interconnect to spokes.
Enable 'export custom routes' on the Hub side of the peering and 'import custom routes' on the spoke side.
This allows the dynamic BGP routes learned by Cloud Router in the Hub VPC over Dedicated Interconnect to be advertised to and learned by the spoke VPC routing tables.
3
Configure private API and GKE master access for internal instances.
Enable Private Google Access on spoke subnets and restrict GKE control plane access to authorized internal IP ranges.
Private Google Access grants internal-only VMs access to Google services, and authorized networks restrict private GKE cluster control plane access to designated internal network segments.

Key Concept

Hub-and-spoke VPC topology design using VPC Network Peering non-transitivity, custom BGP route exchange, and Private Google Access.
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic