Examkin

Question

Difficulty: Very hardConfiguring Hybrid Connectivity and VPN Interconnects

A multinational healthcare enterprise is migrating biomedical imaging workloads to Google Cloud. The primary network architecture requires a high-throughput, unencrypted direct private link supporting a 99.99% availability SLA. Additionally, compliance standards require an independent, IPsec-encrypted backup path established over the public internet with automated failover that prioritizes the direct link when healthy. Which TWO configuration steps must the lead network architect implement to meet both the 99.99% availability SLA and the automated routing requirements?

  1. Provision four Dedicated Interconnect VLAN attachments across two distinct Google Cloud locations (metropolitan areas) and two edge availability domains per location, paired with Cloud Routers using global dynamic routing.Answer
  2. B
    Deploy a single Dedicated Interconnect circuit with two VLAN attachments in one metro area, relying on an active HA VPN connection to compensate and satisfy the 99.99% direct link SLA.
  3. Establish an HA VPN gateway with two IPsec tunnels connected to a Cloud Router, and configure BGP route metrics (such as lower Multi-Exit Discriminator/MED or shorter AS-Path) to favor Dedicated Interconnect routes during normal operation.Answer
  4. D
    Configure VPC Network Peering between the hybrid transit VPC and internal application VPCs to automatically transit on-premises dynamic BGP routes from the VPN gateway to all peered networks.
  5. E
    Apply VPC Service Controls perimeters across the Cloud Routers to automatically enforce IPsec tunnel encryption over the physical Dedicated Interconnect fiber circuits.

Answer

The correct architecture requires provisioning four Dedicated Interconnect VLAN attachments distributed across two separate metropolitan locations and two edge availability domains in each location with global dynamic routing, along with deploying an HA VPN gateway paired with Cloud Router using BGP metrics (such as MED) to ensure traffic prefers the Interconnect route during healthy operation.
To guarantee a 99.99% availability SLA for Dedicated Interconnect, Google Cloud mandates four VLAN attachments deployed across two distinct metropolitan locations and two edge availability domains in each location, linked with Cloud Routers using global dynamic routing. For automated, encrypted failover, deploying HA VPN tunnels and setting BGP attributes (such as lower Multi-Exit Discriminator/MED values on the Interconnect paths) ensures that traffic defaults to the high-throughput direct connection during normal operations and automatically reroutes through the encrypted VPN tunnels if the primary connection fails.

Step-by-Step Solution

1
Evaluate the SLA requirements for Dedicated Interconnect topology.
Determined that achieving a 99.99% SLA for Dedicated Interconnect requires 4 VLAN attachments total: 2 in one metropolitan location (across 2 edge availability domains) and 2 in a separate metropolitan location (across 2 edge availability domains).
Google Cloud's 99.99% availability framework for Dedicated Interconnect explicitly mandates dual-metro, dual-edge domain redundancy with Global Dynamic Routing.
2
Design the encrypted backup path and automated failover strategy using dynamic BGP routing.
Configured HA VPN with Cloud Router and tuned BGP attributes (such as MED or AS-Path prepending).
BGP route attributes allow on-premises and GCP routers to select Dedicated Interconnect as the primary path when available and fail over to the encrypted HA VPN tunnels seamlessly if the primary path degrades.

Key Concept

Configuring 99.99% High Availability Dedicated Interconnect alongside HA VPN backup using Cloud Router dynamic BGP path selection.
Rate this question

Topics

Configuring Hybrid Connectivity and VPN Interconnects

More questions from this topic