Examkin

Question

Difficulty: HardDesigning Network Architecture and Hybrid Connectivity

An international retail logistics enterprise is designing hybrid connectivity between its primary on-premises data center and Google Cloud. The application architecture requires a private connection supporting peak traffic of 6 Gbps6\text{ Gbps} with a guaranteed 99.99%99.99\% availability SLA. Additionally, strict regulatory compliance demands that all data in transit across the hybrid connection must be encrypted using IPsec. Which hybrid networking strategy should the Cloud Architect recommend?

  1. Establish a 99.99% Availability topology using Dedicated Interconnect, and configure HA VPN over the Cloud Interconnect attachments to encrypt all transit traffic.Answer
  2. B
    Deploy standard HA VPN gateways over the public internet, scaling the number of active IPsec tunnels to achieve the required 6 Gbps aggregate throughput.
  3. C
    Provision a single 10 Gbps Partner Interconnect VLAN attachment, relying on Google Cloud default internal network encryption to secure cross-site transport.
  4. D
    Establish VPC Network Peering between the on-premises router and a central Google Cloud hub VPC to enable dynamic BGP route propagation to all spoke VPCs.

Answer

Establish a 99.99% Availability topology using Dedicated Interconnect, and configure HA VPN over the Cloud Interconnect attachments to encrypt all transit traffic.
The solution establishing a 99.99% Availability configuration using Dedicated Interconnect layered with HA VPN over Cloud Interconnect is correct. Dedicated Interconnect across redundant edge facilities provides the multi-gigabit bandwidth and strict SLA required by enterprise workloads, while HA VPN over Interconnect enforces IPsec encryption for all transit data across the private physical links.

Step-by-Step Solution

1
Analyze SLA and bandwidth constraints
Peak throughput of 6 Gbps6\text{ Gbps} combined with a 99.99%99.99\% availability requirement mandates a redundant Cloud Interconnect deployment across two metro locations rather than public internet VPN.
Public internet HA VPN connections provide a 99.99%99.99\% SLA for the GCP gateway endpoints, but cannot guarantee SLA for the underlying internet transport path.
2
Analyze security and encryption constraints
Deploying HA VPN over Cloud Interconnect satisfies IPsec encryption in transit while leveraging the high-speed, private Interconnect physical links.
Cloud Interconnect by default transfers raw Ethernet packets without IPsec encryption; layering HA VPN over Interconnect attachments adds IPsec layer-3 security to private links.
3
Evaluate alternative networking patterns for compliance and topology limits
Single connections lack high-availability redundancy, and VPC Network Peering cannot extend to on-premises hardware or provide transitive hub-and-spoke routing.
VPC Peering strictly connects GCP VPCs and does not support transitive routing or on-premises BGP peerings.

Key Concept

HA VPN over Cloud Interconnect Architecture
Estimated Time:2m 0s
Rate this question

Topics

Designing Network Architecture and Hybrid Connectivity