Examkin

Soru

Zorluk: OrtaConfiguring Network Topology and VPC Infrastructure

An enterprise organization is building a hybrid cloud infrastructure on Google Cloud. The architecture requires private connectivity between an on-premises data center and two Google Cloud Virtual Private Cloud (VPC) networks: VPC-A in region us-central1 and VPC-B in region us-east4. Compute workloads in VPC-A need to communicate directly with VPC-B over a high-bandwidth internal connection. Additionally, on-premises systems must communicate securely with VPC-A over a dedicated 10 Gbps connection, but on-premises systems must be explicitly blocked from transitively accessing resources in VPC-B through VPC-A. Which TWO network topology configurations should you implement to meet these requirements? (Select TWO.)

  1. Establish a VPC Network Peering connection directly between VPC-A and VPC-B to allow private, low-latency inter-VPC traffic.Cevap
  2. Deploy Cloud Routers in VPC-A attached to Dedicated Interconnect VLAN attachments and configure Custom Route Advertisements to advertise only VPC-A's subnet ranges to on-premises.Cevap
  3. C
    Enable custom route exchange on the VPC-A Cloud Router to transitively advertise BGP routes learned from VPC-B over the Dedicated Interconnect to the on-premises routers.
  4. D
    Provision an HA VPN gateway with two IPsec tunnels operating over the public internet to connect the on-premises data center directly to VPC-A.
  5. E
    Rely strictly on Identity and Access Management (IAM) role restrictions on compute instances in VPC-A to prevent on-premises users from exfiltrating data to external Cloud Storage buckets.

Cevap

To establish the required topology, establish a direct VPC Network Peering connection between VPC-A and VPC-B, and deploy Cloud Routers with Dedicated Interconnect VLAN attachments in VPC-A using custom route advertisements restricted to VPC-A subnets.
Establishing direct VPC Network Peering between VPC-A and VPC-B provides private inter-VPC routing. Using Dedicated Interconnect with Cloud Router in VPC-A satisfies the 10 Gbps dedicated bandwidth requirement while allowing granular custom route advertisements so on-premises routers only receive VPC-A subnet routes.

Adım Adım Çözüm

1
Select the appropriate hybrid connectivity mechanism based on bandwidth requirements.
Dedicated Interconnect is chosen over HA VPN because the requirement demands a dedicated 10 Gbps line, exceeding typical single-tunnel HA VPN capabilities.
HA VPN supports up to 3 Gbps per tunnel, whereas Dedicated Interconnect provides 10 Gbps or 100 Gbps dedicated circuits.
2
Configure inter-VPC connectivity between VPC-A and VPC-B.
A direct VPC Network Peering connection is configured between VPC-A and VPC-B.
VPC Peering provides direct, private RFC 1918 communication between VPC networks with zero bandwidth bottlenecks.
3
Ensure non-transitive routing behavior to prevent on-premises traffic from reaching VPC-B.
Configure custom route advertisements on the VPC-A Cloud Routers to advertise only VPC-A subnets over BGP.
VPC Network Peering is inherently non-transitive in Google Cloud; routes learned from a peered VPC cannot be forwarded over Cloud Interconnect to on-premises.

Anahtar Kavram

Configuring Network Topology and VPC Infrastructure
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Configuring Network Topology and VPC Infrastructure

Bu konudan daha fazla soru