Examkin

Question

Difficulty: Very hardConfiguring Network Topology and VPC Infrastructure

An enterprise organization is building a multi-region hybrid cloud environment on Google Cloud. The architecture consists of a Shared VPC network managed in a central host project with subnets provisioned in both `us-central1` and `europe-west1`. On-premises data centers connect to GCP via Dedicated Interconnect attachments in `us-central1`. The architecture team requires that on-premises workloads dynamically discover and route traffic to resources in both GCP regions over the Interconnect. Additionally, spoke workloads in service projects must access managed GCP services and external SaaS partners strictly through private IP addresses without traversing the public internet, while maintaining network isolation between independent spokes. Which TWO network topology configuration steps must you implement in the Shared VPC to satisfy these requirements? (Select TWO.)

  1. Set the dynamic routing mode of the Shared VPC network to Global, and configure Cloud Routers in us-central1 to advertise subnet routes across both regions over BGP.Answer
  2. Configure Private Service Connect (PSC) endpoints using internal IP addresses in the Shared VPC subnets to route traffic privately to consumer endpoints and Google APIs.Answer
  3. C
    Establish VPC Network Peering between all spoke VPC networks and configure the host VPC to act as a transitive transit router for inter-spoke traffic.
  4. D
    Replace the Dedicated Interconnect setup with HA VPN tunnels using static routing to handle multi-region 10 Gbps bandwidth requirements to on-premises.
  5. E
    Configure Cloud NAT gateways in each spoke project and enforce IAM object viewer roles to prevent unauthorized data exfiltration over public endpoints.

Answer

The correct architecture requires setting the Shared VPC dynamic routing mode to Global so Cloud Routers in us-central1 can exchange routes for subnets in all regions (including europe-west1) over BGP, and provisioning Private Service Connect endpoints with internal IP addresses for private access to APIs and SaaS solutions.
To allow an on-premises data center connected via Dedicated Interconnect in one region (`us-central1`) to dynamically learn and route traffic to subnets in another region (`europe-west1`), the VPC network's dynamic routing mode must be configured to Global. Additionally, using Private Service Connect endpoints provisions internal IP addresses inside the Shared VPC subnets, allowing private, secure connectivity to Google APIs and managed SaaS services.

Step-by-Step Solution

1
Analyze dynamic routing requirements for multi-region Interconnect connectivity.
Regional dynamic routing only advertises local regional subnets. Setting dynamic routing to Global allows Cloud Router in us-central1 to advertise europe-west1 subnets over Interconnect BGP sessions.
On-premises systems need reachability to all GCP regional subnets across a single Interconnect connection.
2
Determine private access implementation for external services and Google APIs.
Deploy Private Service Connect (PSC) endpoints within Shared VPC subnets.
PSC endpoints allocate internal IP addresses in the consumer VPC, granting secure, private access to published services without public IP exposure or internet routing.
3
Evaluate and eliminate invalid topology design choices.
Reject VPC Peering transitivity assumptions, HA VPN replacement for 10Gbps Dedicated Interconnect, and Cloud NAT usage for private API access.
VPC Peering does not support transitive routing, HA VPN cannot match Dedicated Interconnect throughput, and Cloud NAT uses public egress routing.

Key Concept

Shared VPC Global Dynamic Routing and Private Service Connect Topology
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic