Examkin

Question

Difficulty: Very hardConfiguring Network Topology and VPC Infrastructure

A multinational SaaS provider hosts a core analytics engine in a central GCP project's VPC network. Multiple independent enterprise customers need private, low-latency TCP connectivity from their own distinct GCP VPC networks to this central analytics engine. The customer VPC networks frequently have overlapping RFC 1918 internal IP address ranges with each other and with the service provider network. Furthermore, security policies require that customers must only have unidirectional access to initiate connections toward the analytics service, preventing any customer from reaching another customer's network or exposing the provider's internal topology. Which VPC networking design should you implement to satisfy these architecture requirements?

  1. Configure Private Service Connect endpoints in each customer VPC targeting a Service Attachment published in the analytics provider VPC behind an Internal HTTP(S) Load Balancer.Answer
  2. B
    Establish VPC Network Peering between each customer VPC and the central analytics provider VPC, relying on Cloud NAT in the provider VPC to translate overlapping IP ranges.
  3. C
    Deploy High Availability (HA) VPN tunnels between each customer VPC and the provider VPC, establishing dynamic routing via Cloud Router to resolve IP overlaps.
  4. D
    Place all customer projects and the analytics provider project into a single shared VPC Service Controls perimeter and rely on IAM role bindings to enforce private reachability.

Answer

Configure Private Service Connect endpoints in each customer VPC targeting a Service Attachment published in the analytics provider VPC behind an Internal HTTP(S) Load Balancer.
The correct design uses Private Service Connect (PSC). PSC allows private service consumption across separate VPC networks even when IP addresses overlap. It allocates an endpoint IP inside the consumer VPC that maps directly to a producer Service Attachment behind an Internal Load Balancer, providing secure, low-latency, and strictly unidirectional service access without exposing raw network topologies.

Step-by-Step Solution

1
Analyze connectivity, IP overlap, and directionality requirements.
Identify that tenants have overlapping RFC 1918 IP addresses and require isolated, unidirectional connectivity to a centralized service.
VPC Network Peering cannot be used when IP CIDR blocks overlap across networks.
2
Evaluate Private Service Connect (PSC) capability for multi-tenant service publishing.
PSC abstracts the producer infrastructure by exposing service endpoints in consumer VPCs using consumer-assigned internal IP addresses.
PSC NAT translates connection packets automatically, resolving IP collision issues and restricting reachability to unidirectional service traffic.
3
Verify service attachment backend integration in the producer network.
Publishing the service attachment behind an Internal HTTP(S) Load Balancer or Internal Passthrough Network Load Balancer provides highly available backend routing.
This meets all architectural constraints around security isolation, low latency, IP overlap handling, and zero transitive route exposure.

Key Concept

Private Service Connect for Overlapping IP Networks and Service-Centric Publishing
Estimated Time:3m 0s
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic