Examkin

Question

Difficulty: MediumDesigning Network Architecture and Hybrid Connectivity

A global pharmaceutical enterprise is designing a hybrid cloud architecture to connect its on-premises laboratory network to Google Cloud. The architecture must host workloads across two distinct projects—Production and Analytics. The connectivity solution must support an aggregate peak bandwidth of 2 Gbps, provide an SLA of 99.99%, enforce end-to-end IPsec encryption in transit, and minimize operational deployment costs. On-premises systems must be able to communicate securely with workloads in both project environments. Which architectural design should a Cloud Architect recommend?

  1. A
    Deploy HA VPN gateways with Cloud Router in the Production VPC, and establish VPC Network Peering between the Production VPC and the Analytics VPC to extend on-premises connectivity to the Analytics workloads.
  2. B
    Provision a 10 Gbps Dedicated Interconnect connection with redundant VLAN attachments connected to Cloud Routers in both project VPCs.
  3. Create a Shared VPC architecture hosted in a centralized administration project with subnets for Production and Analytics workloads, and connect the Host VPC to on-premises using HA VPN gateways and Cloud Router.Answer
  4. D
    Deploy a single Classic VPN gateway with static routing in each project VPC, pointing traffic to the on-premises VPN gateway over the public internet.

Answer

The correct architecture uses a Shared VPC host network containing subnets for Production and Analytics workloads, connected to the on-premises environment via HA VPN gateways with Cloud Router.
Establishing a Shared VPC architecture consolidates the networking layer into a central host project while allowing distinct workload projects (Production and Analytics) to manage their respective resources. A single HA VPN deployment with Cloud Router in the host VPC satisfies the 2 Gbps throughput requirement (within the 3 Gbps per tunnel capacity), provides built-in IPsec encryption, guarantees 99.99% availability, and minimizes deployment cost.

Step-by-Step Solution

1
Evaluate throughput and encryption requirements
The requirement is 2 Gbps with IPsec encryption in transit. High Availability (HA) VPN supports up to 3 Gbps per tunnel with native IPsec encryption and a 99.99% SLA at a significantly lower cost than Dedicated Interconnect.
Choosing Dedicated Interconnect for 2 Gbps is cost-inefficient when HA VPN meets throughput, encryption, and availability constraints.
2
Evaluate multi-project hybrid network topology
VPC Network Peering does not allow transitive traffic from hybrid connections (on-premises cannot reach VPC B through VPC A via peering). Using Shared VPC places Production and Analytics subnets into a unified network space under a host project.
Shared VPC allows a single HA VPN deployment in the host network to route traffic seamlessly to all service project subnets without hitting transitive routing limitations.

Key Concept

Shared VPC and HA VPN Hybrid Network Integration
Rate this question

Topics

Designing Network Architecture and Hybrid Connectivity