Examkin

Question

Difficulty: HardConfiguring Network Topology and VPC Infrastructure

An organization is provisioning a multi-region Google Cloud infrastructure spanning `us-central1` and `europe-west1`. The architecture requires a high-throughput hybrid network connection to an on-premises data center supporting 20 Gbps bandwidth with automated cross-region route failover. Additionally, private GKE clusters deployed in the application subnets must access Cloud Storage securely without public internet exposure, and administrative access to the GKE control plane must be limited strictly to an internal administration subnet CIDR. Which TWO network topology configurations and architectural decisions should the Cloud Architect implement? (Select TWO)

  1. Provision Dedicated Interconnect circuits with VLAN attachments connected to Cloud Routers in both regions, and set the VPC Dynamic Routing Mode to Global.Answer
  2. Enable Private Google Access on the GKE node subnets and configure Control Plane Authorized Networks on the GKE clusters specifying the internal administration subnet CIDR.Answer
  3. C
    Connect multiple spoke VPC networks to a central hub VPC using VPC Network Peering to allow spokes to route traffic transitively through the hub to the on-premises network.
  4. D
    Deploy HA VPN gateways with dual IPsec tunnels in each region to achieve 20 Gbps continuous throughput per tunnel across the hybrid topology.
  5. E
    Rely exclusively on Identity and Access Management (IAM) role bindings on Cloud Storage buckets to prevent authorized internal compute nodes from exfiltrating data to external Google Cloud projects.

Answer

The correct configurations are provisioning Dedicated Interconnect with Global Dynamic Routing enabled on the VPC network, and enabling Private Google Access on GKE subnets while configuring Control Plane Authorized Networks.
To achieve 20 Gbps hybrid connectivity with cross-region failover, Dedicated Interconnect must be combined with Cloud Routers using Global Dynamic Routing, allowing BGP routes to propagate across all regions in the VPC. For securing GKE infrastructure, Private Google Access allows private VM nodes to communicate with Cloud Storage over internal routes, while GKE Control Plane Authorized Networks restrict master access exclusively to trusted internal subnet ranges.

Step-by-Step Solution

1
Analyze hybrid connectivity throughput and dynamic failover requirements.
Dedicated Interconnect satisfies the 20 Gbps bandwidth requirement (exceeding standard 3 Gbps HA VPN tunnel limits). Setting VPC dynamic routing to Global enables Cloud Routers in `us-central1` and `europe-west1` to exchange BGP routes across regions for automated failover.
Regional dynamic routing limits BGP route propagation strictly to the local region, whereas Global dynamic routing shares learned routes across all regions within the VPC.
2
Evaluate GKE private access and master security endpoint configuration.
Private Google Access allows instances without external IP addresses to reach Google APIs (such as Cloud Storage) internally. Control Plane Authorized Networks block unauthorized IP traffic from accessing the GKE cluster control plane.
These combined settings ensure data paths to storage remain on internal Google infrastructure and cluster administration is restricted strictly to designated internal management subnets.
3
Identify and reject invalid networking assumptions.
Discard non-transitive VPC peering designs, single-tunnel HA VPN for high throughput requirements, and IAM-only data exfiltration controls.
VPC Peering does not support transitive routing, Cloud VPN cannot support 20 Gbps per tunnel, and IAM alone cannot stop network exfiltration without VPC Service Controls.

Key Concept

Configuring Global Dynamic Routing with Dedicated Interconnect and Securing Private VPC Subnet Access
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic