Examkin

Soru

Zorluk: OrtaConfiguring Network Topology and VPC Infrastructure

An enterprise organization is designing a hub-and-spoke VPC network architecture in Google Cloud. The central Hub VPC must communicate independently with two separate workload VPCs (Spoke-A and Spoke-B). The topology must satisfy two key requirements: first, Spoke-A and Spoke-B must remain network-isolated from each other such that traffic cannot transit through the Hub VPC between the two spokes; second, the organization requires a dedicated 10 Gbps private connection to an on-premises data center without traversing the public internet. Which TWO architectural decisions should the network team implement? (Select TWO)

  1. Establish VPC Network Peering between the Hub VPC and Spoke-A, and separately between the Hub VPC and Spoke-B, relying on the default non-transitive routing of VPC Peering to enforce isolation between Spoke-A and Spoke-B.Cevap
  2. Provision a Dedicated Interconnect connection between the on-premises co-location facility and a Google Cloud edge location to support SLA-backed 10 Gbps private traffic.Cevap
  3. C
    Configure VPC Network Peering between Hub and Spoke-A, and Hub and Spoke-B, while relying on transitive routing through the Hub VPC to allow Spoke-A to communicate directly with Spoke-B.
  4. D
    Deploy a High Availability (HA) VPN gateway with multiple IPsec tunnels over the public internet to deliver the required dedicated 10 Gbps baseline connection to the on-premises facility.
  5. E
    Rely strictly on Identity and Access Management (IAM) bucket permissions without network isolation controls to block unauthorized traffic between Spoke-A and Spoke-B.

Cevap

The correct decisions are to establish separate VPC Network Peering connections from the Hub VPC to each Spoke VPC to leverage non-transitive routing for network isolation, and to deploy Dedicated Interconnect for 10 Gbps private hybrid connectivity.
Establishing separate VPC Network Peering connections between the Hub VPC and each Spoke VPC correctly leverages Google Cloud's non-transitive peering model, which ensures that traffic between Spoke-A and Spoke-B cannot traverse the Hub VPC. Additionally, provisioning Dedicated Interconnect provides high-capacity, SLA-backed 10 Gbps private hybrid connectivity between the on-premises environment and Google Cloud.

Adım Adım Çözüm

1
Evaluate inter-VPC traffic isolation requirements.
VPC Network Peering in Google Cloud is non-transitive by default. Peering Hub to Spoke-A and Hub to Spoke-B allows Hub-to-Spoke communication while automatically preventing Spoke-A from reaching Spoke-B through the Hub.
This natively satisfies the isolation requirement between Spoke-A and Spoke-B.
2
Evaluate hybrid connectivity bandwidth and SLA requirements.
Dedicated Interconnect provides private 10 Gbps (or 100 Gbps) physical links directly to Google's edge network.
VPN solutions route over the public internet and cannot scale to a dedicated 10 Gbps baseline per circuit.

Anahtar Kavram

VPC Network Topology, Non-Transitive Peering, and Hybrid Interconnect
Bu soruyu puanla

Konular

Configuring Network Topology and VPC Infrastructure

Bu konudan daha fazla soru