Examkin

Question

Difficulty: MediumConfiguring Network Topology and VPC Infrastructure

An enterprise organization maintains a centralized network architecture in Google Cloud. A primary network project contains a Virtual Private Cloud network named hub-vpc, which connects to an on-premises datacenter via Dedicated Interconnect using Cloud Router dynamic routing. Application workloads are deployed in a separate project within a Virtual Private Cloud network named spoke-vpc. You need to provide private layer-3 reachability so compute instances in spoke-vpc can communicate with on-premises servers over the existing Dedicated Interconnect connection. Which network topology configuration should you implement?

  1. Establish VPC Network Peering between hub-vpc and spoke-vpc, and configure the peering connection to export custom routes from hub-vpc and import custom routes into spoke-vpc.Answer
  2. B
    Establish VPC Network Peering between spoke-vpc and an intermediate management VPC, relying on default transitive routing behavior to forward traffic from spoke-vpc through management VPC to hub-vpc.
  3. C
    Replace the Dedicated Interconnect attachment in hub-vpc with a HA VPN gateway in spoke-vpc, because Dedicated Interconnect attachments cannot carry traffic originating from outside their local VPC.
  4. D
    Configure a VPC Service Control perimeter enclosing hub-vpc and spoke-vpc, which automatically establishes underlying network routes between the enclosed VPC networks and on-premises resources.

Answer

Establish VPC Network Peering between hub-vpc and spoke-vpc, configuring the peering connection to export custom routes from hub-vpc and import custom routes into spoke-vpc.
Establishing VPC Network Peering directly between hub-vpc and spoke-vpc while enabling custom route export on hub-vpc and custom route import on spoke-vpc allows dynamic routes learned via Dedicated Interconnect in hub-vpc to be propagated directly into spoke-vpc's routing table.

Step-by-Step Solution

1
Identify the requirement for inter-VPC reachability to on-premises resources over Dedicated Interconnect.
Recognize that compute instances in spoke-vpc require routes to the on-premises IP ranges learned by Cloud Router in hub-vpc.
Cloud Router in hub-vpc learns on-premises routes via BGP over Dedicated Interconnect VLAN attachments.
2
Evaluate VPC Network Peering routing capabilities and limitations.
Determine that VPC Network Peering allows sharing subnets and dynamic custom routes between directly peered networks, but routing is non-transitive across multiple peering hops.
Direct peering between hub-vpc and spoke-vpc is required, along with enabling custom route flags.
3
Configure custom route export and import flags on the VPC Network Peering connection.
hub-vpc exports custom routes (on-premises BGP learned routes) and spoke-vpc imports custom routes, enabling bidirectional communication between spoke-vpc and on-premises.
By default, VPC Network Peering only exchanges subnet routes; custom route flags must be explicitly enabled to propagate dynamic BGP routes across peering boundaries.

Key Concept

VPC Network Peering Custom Route Exchange
Estimated Time:1m 30s
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic