Examkin

Question

Difficulty: HardConfiguring Network Topology and VPC Infrastructure

An enterprise organization operates a Google Cloud Shared VPC infrastructure with a Host Project for core network management and multiple Service Projects housing distinct microservice applications. The architecture team needs to enable microservices in Service Project A to privately consume an API hosted in an external software vendor's Google Cloud VPC. The solution must strictly prevent transitive network access to other Service Projects attached to the Host VPC, eliminate any risk of IP address space overlap, and avoid routing traffic across the public internet. Which network topology configuration should you implement?

  1. A
    Establish a VPC Network Peering connection between the Shared VPC host network and the external vendor's VPC network to enable subnet route propagation.
  2. Configure Private Service Connect endpoints in Service Project A targeting the external vendor's published Service Attachment.Answer
  3. C
    Deploy a Cloud NAT gateway in the Host Project VPC and route outbound traffic from Service Project A to the vendor's public service endpoint.
  4. D
    Provision a Dedicated Interconnect connection between the Shared VPC host network and the external vendor's environment.

Answer

Configuring Private Service Connect endpoints in Service Project A targeting the external vendor's published Service Attachment provides isolated, private, and non-transitive access.
Private Service Connect (PSC) enables private, unidirectional consumption of services across GCP VPCs and organizations. By creating a PSC endpoint inside Service Project A, microservices communicate with the vendor's service using an internal IP address provisioned in Service Project A's subnet. This traffic traverses Google's internal network without requiring VPC Network Peering, avoiding transitivity constraints, eliminating CIDR range overlap issues, and isolating the connection strictly to the initiating service project.

Step-by-Step Solution

1
Analyze network isolation and transitivity constraints
Identified that VPC Network Peering does not allow transitive routing across hub/host networks, rendering VPC Peering ineffective for attached Service Projects.
Google Cloud VPC Network Peering only exchanges routes between directly peered networks and explicitly blocks transit routing.
2
Evaluate inter-tenant private service connectivity options
Selected Private Service Connect (PSC) as the matching architecture pattern.
PSC allows consumer VPCs to deploy internal IP endpoints that map directly to a producer's Service Attachment via Network Load Balancing, without peering or sharing IP address ranges.
3
Validate security and boundary requirements
PSC endpoints ensure traffic remains within Google's private network, avoids IP overlaps via NAT translation at the PSC layer, and prevents transitive access to other Service Projects.
PSC endpoints are scoped specifically to the consumer network where they are provisioned and do not expose broader network topology routes.

Key Concept

Private Service Connect vs VPC Peering Transitivity in Shared VPC Architectures
Estimated Time:2m 0s
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic