Examkin

Question

Difficulty: MediumConfiguring Network Topology and VPC Infrastructure

An enterprise organization is deploying workloads in a Shared VPC network on Google Cloud. The infrastructure team must establish secure, private connectivity from compute instances in a service project to a third-party managed database service hosted in another Google Cloud tenant project. The third-party provider uses an internal IP address range that overlaps with the organization's subnet ranges, preventing the use of standard VPC Network Peering. Which network configuration should the Cloud Architect implement to meet these requirements?

  1. Create a Private Service Connect endpoint in the consumer Shared VPC that targets the published Service Attachment of the managed database provider.Answer
  2. B
    Establish a VPC Network Peering connection between the Shared VPC and the third-party provider VPC network while disabling custom route export.
  3. C
    Provision a Dedicated Interconnect connection directly between the consumer project and the third-party provider project.
  4. D
    Configure a VPC Service Controls perimeter around the consumer Shared VPC and grant the third-party service account IAM access.

Answer

Create a Private Service Connect endpoint in the consumer Shared VPC that targets the published Service Attachment of the managed database provider.
Private Service Connect endpoints allow consumers to access services published in another VPC using a private IP address allocated from the consumer's own local VPC subnet. Because traffic is translated through the endpoint and Service Attachment, overlapping IP ranges between the consumer and producer VPC networks do not block communication.

Step-by-Step Solution

1
Analyze network isolation and overlapping IP constraints
Identified that traditional VPC Network Peering cannot be established due to overlapping IP CIDR ranges between the enterprise Shared VPC and the third-party provider VPC.
VPC Peering requires strictly non-overlapping IP subnets to construct valid routing tables across peered networks.
2
Evaluate private service delivery mechanisms in Google Cloud
Selected Private Service Connect (PSC) endpoints as the optimal architecture.
PSC uses NAT-like functionality where the consumer allocates an endpoint IP from its own local subnet, mapping traffic privately to the producer's Service Attachment regardless of IP address collisions in the producer network.

Key Concept

Private Service Connect Endpoint for Cross-Tenant VPC Access
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic