Examkin

Question

Difficulty: MediumConfiguring Network Topology and VPC Infrastructure

An organization is configuring a custom VPC network topology for Compute Engine instances running in a private subnet with no external IP addresses. The workloads require secure access to Google Cloud APIs (such as Cloud Storage) and need to consume a microservice hosted in an external vendor's VPC project without exposing internal IP ranges or allowing transitive network access through intermediate VPCs. Which network topology configuration satisfies these requirements?

  1. Enable Private Google Access on the private subnet for Google Cloud API connectivity, and deploy a Private Service Connect endpoint to consume the vendor microservice privately.Answer
  2. B
    Configure VPC Network Peering between the workload VPC and a central transit VPC that is already peered with the vendor's VPC to route API traffic transitively.
  3. C
    Establish an HA VPN gateway with dynamic BGP routing between the private subnet and the vendor VPC to route both Google Cloud API and vendor service traffic across IPSec tunnels.
  4. D
    Assign fine-grained IAM roles to the Compute Engine instances to allow Cloud Storage access while leaving network routing unchanged without Private Google Access or network perimeters.

Answer

Enable Private Google Access on the private subnet for Google APIs and deploy a Private Service Connect endpoint to access the external service.
The correct answer combines Private Google Access for native GCP API connectivity with Private Service Connect endpoints for consuming external published services. This fulfills all requirements without exposing public IPs, relying on transitive peering, or deploying complex VPN gateways.

Step-by-Step Solution

1
Analyze network access requirements for Google APIs from private subnets.
Enabling Private Google Access allows Compute Engine instances lacking external IP addresses to communicate with Google APIs via internal routing.
Without public IP addresses or Cloud NAT, instances cannot reach default public Google API endpoints unless Private Google Access is enabled.
2
Determine the optimal cross-project connectivity mechanism for consuming vendor services without transitivity.
Deploying a Private Service Connect (PSC) endpoint creates a local IP inside the workload subnet that forwards traffic securely to the published service.
PSC endpoints avoid transitivity limitations of VPC Network Peering and do not require overlapping IP management or complex VPN setups.

Key Concept

Private Google Access & Private Service Connect Topology
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic