Examkin

Question

Difficulty: MediumConfiguring Network Topology and VPC Infrastructure

A financial institution is configuring its Google Cloud VPC infrastructure to provide private, secure access to a third-party SaaS provider hosted on GCP. The workload instances reside in private subnets across multiple regions within a single consumer VPC network, and on-premises operators access this VPC via a Dedicated Interconnect connection. The networking design must allow both Google Cloud Compute Engine instances and on-premises clients to access the vendor's service attachment privately without exposing traffic to the public internet or establishing direct VPC Network Peering with the vendor network. Which TWO configuration steps should the network architect implement?

  1. Provision a Private Service Connect (PSC) consumer endpoint using an internal IP address from a subnet within the consumer VPC network.Answer
  2. Configure custom route advertisements on the Cloud Router associated with the Dedicated Interconnect to announce the PSC endpoint IP address range to the on-premises network.Answer
  3. C
    Establish a VPC Network Peering connection between the consumer VPC and the SaaS provider's VPC so on-premises Interconnect traffic can route transitively to the vendor.
  4. D
    Replace the Dedicated Interconnect with HA VPN tunnels configured with dynamic BGP to enable transitive route reflection into third-party VPC boundaries.
  5. E
    Configure a VPC Service Controls perimeter rule to automatically expose the SaaS producer endpoint directly to on-premises IP ranges without network route advertisement.

Answer

Provision a Private Service Connect (PSC) consumer endpoint using an internal IP address within the consumer VPC network, and configure custom route advertisements on the Cloud Router associated with the Dedicated Interconnect to announce the PSC endpoint IP address to the on-premises network.
Private Service Connect (PSC) allows the consumer VPC to allocate an internal IP address endpoint that targets a producer's published service attachment without establishing VPC Peering. To extend reachability to on-premises environments connected via Dedicated Interconnect, the Cloud Router managing the Interconnect BGP session must be configured with custom route advertisements for the PSC endpoint IP address.

Step-by-Step Solution

1
Identify the private service publishing mechanism that avoids direct VPC Peering.
Private Service Connect (PSC) allows consumers to access published services privately using internal IP addresses within their own VPC without network peering.
PSC endpoints insulate network topologies and prevent overlapping IP address space conflicts between consumer and producer networks.
2
Determine how on-premises clients reach the published service endpoint over Dedicated Interconnect.
Configure custom route advertisements on the Cloud Router BGP session to explicitly advertise the PSC endpoint IP address or subnet to on-premises routers.
By default, Cloud Router advertises subnet primary and secondary ranges, but PSC endpoint IP rules require explicit custom route advertisement to be reachable across Cloud Interconnect.

Key Concept

Private Service Connect Endpoint Integration with On-Premises Networks via Cloud Router Custom Route Advertisement
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic