Examkin

Question

Difficulty: MediumConfiguring Network Topology and VPC Infrastructure

An enterprise infrastructure team is configuring hybrid network connectivity between an on-premises data center and Google Cloud over a Dedicated Interconnect. On-premises workloads require private access to Google APIs (such as Cloud Storage and BigQuery) through a Private Service Connect (PSC) endpoint provisioned in the hub Virtual Private Cloud (VPC) network. The PSC endpoint has been assigned an internal IP address from the VPC subnet. Which TWO actions must the network architect perform to enable on-premises workloads to successfully reach Google APIs using this Private Service Connect endpoint?

  1. Configure custom route advertisements on the Cloud Router managing the Dedicated Interconnect BGP session to advertise the Private Service Connect endpoint IP address to the on-premises router.Answer
  2. Configure on-premises DNS infrastructure to resolve target Google API domain names to the internal IP address of the Private Service Connect endpoint.Answer
  3. C
    Establish a VPC Network Peering connection between the hub VPC and an intermediary VPC, relying on peering transitivity to propagate the endpoint IP to on-premises routers.
  4. D
    Replace the Dedicated Interconnect connection with an HA VPN gateway tunnel to bypass BGP custom route advertisement restrictions for internal service endpoints.
  5. E
    Remove GKE control plane authorized network restrictions across all subnets to grant on-premises systems direct access to internal Google service endpoints.

Answer

To enable on-premises workloads to reach Google APIs via a Private Service Connect endpoint in a VPC, the architect must configure custom route advertisements on the Cloud Router associated with the Dedicated Interconnect to advertise the endpoint IP address over BGP, and configure on-premises DNS to resolve Google API domains to the internal Private Service Connect endpoint IP address.
Enabling on-premises access to Google APIs via Private Service Connect requires two essential networking steps: routing propagation and DNS resolution. First, the Cloud Router connected to the Dedicated Interconnect must be configured with a custom route advertisement so on-premises routers learn the path to the internal PSC IP. Second, on-premises DNS must be configured to resolve target Google API domain names to the internal PSC endpoint IP address so that client requests are routed privately over the Interconnect.

Step-by-Step Solution

1
Configure Cloud Router BGP Custom Route Advertisements
The internal IP address of the Private Service Connect endpoint is advertised over BGP to the on-premises routers.
By default, Cloud Router only advertises VPC subnet primary and secondary ranges over BGP. Private Service Connect endpoint IP addresses require explicit custom route advertisement on the Cloud Router to be reachable from on-premises.
2
Configure On-Premises DNS Resolution
On-premises API calls targeting Google services (such as *.googleapis.com) resolve to the internal IP address of the Private Service Connect endpoint.
Traffic must be directed to the internal PSC endpoint IP address instead of public IP addresses. Setting up DNS forwarding or local response policies ensures traffic stays private across the Interconnect.

Key Concept

Configuring Hybrid Connectivity and Private Service Connect Routing
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic