Examkin

Soru

Zorluk: ZorDeploying Cloud Load Balancers and Configuring Cloud DNS

Your enterprise organization maintains a central networking project named net-host-proj containing a Google Cloud Virtual Private Cloud network named vpc-shared. A separate application development project named app-dev-proj contains its own VPC network named vpc-app-dev. You are deploying a internal Cloud DNS private zone named app.internal in net-host-proj to host custom A records for internal microservices. Virtual machine instances located in both vpc-shared and vpc-app-dev must be able to resolve domain names in the app.internal zone without exposing DNS queries to the public internet. Which TWO actions must you perform to configure Cloud DNS and VPC networking to satisfy this requirement?

  1. Add both vpc-shared and vpc-app-dev to the list of authorized networks when creating or updating the app.internal private DNS zone in net-host-proj.Cevap
  2. B
    Enable the Cloud DNS API inside app-dev-proj to allow instances in vpc-app-dev to query private DNS records residing in net-host-proj.
  3. C
    Ensure Service Account Impersonation or broad organization-level IAM roles are granted to VM instances in vpc-app-dev so they inherit access to net-host-proj resources.
  4. Create a Cloud DNS peering zone in app-dev-proj for app.internal that targets vpc-shared in net-host-proj as the peer network.Cevap

Cevap

To allow VMs across different VPC networks and projects to resolve custom names in a Cloud DNS private zone, you can either explicitly authorize both VPC networks (vpc-shared and vpc-app-dev) on the private zone in the central project, or set up a Cloud DNS peering zone in the consumer project (app-dev-proj) that targets the host network (vpc-shared).
The correct options represent the two valid approaches in Google Cloud for cross-VPC Cloud DNS private zone resolution. Option A directly adds multiple authorized VPC networks across projects to the private zone configuration. Option D establishes a Cloud DNS peering zone in the consumer project that delegates queries for the private domain to the network hosting the private zone.

Adım Adım Çözüm

1
Identify the multi-VPC private DNS resolution options in Google Cloud.
Cloud DNS supports authorizing multiple VPC networks (even across projects with appropriate permissions) on a single private zone, or configuring Cloud DNS Peering zones.
This allows instances in distinct VPC networks to resolve internal domain names managed within a centralized private DNS zone.
2
Evaluate the authorized networks strategy.
Adding both vpc-shared and vpc-app-dev as authorized networks to the app.internal private zone allows instances in both VPC networks to resolve names directly.
Cloud DNS private zones resolve queries originating from any authorized VPC network specified in the zone configuration.
3
Evaluate the DNS peering strategy.
Creating a Cloud DNS peering zone in app-dev-proj for app.internal that targets vpc-shared in net-host-proj enables vpc-app-dev to delegate DNS queries to vpc-shared.
DNS Peering allows a consumer VPC to resolve private DNS names hosted in another network without directly modifying the primary private zone authorization.

Anahtar Kavram

Cloud DNS Private Zone Network Authorization and DNS Peering across VPCs
Bu soruyu puanla

Konular

Deploying Cloud Load Balancers and Configuring Cloud DNS

Bu konudan daha fazla soru