Examkin

Soru

Zorluk: OrtaConfiguring Network Topology and VPC Infrastructure

An organization is deploying an internal analytics service in a Producer VPC behind an Internal HTTP(S) Load Balancer. Multiple independent consumer projects with overlapping IP address spaces require secure, private access to this analytics API without enabling full IP routing or VPC Network Peering between the consumer VPCs. Which TWO network topology configurations must you implement to establish this connectivity?

  1. Create a Service Attachment in the Producer VPC that references the Internal HTTP(S) Load Balancer's forwarding rule.Cevap
  2. B
    Configure VPC Network Peering between each consumer VPC and the Producer VPC, enabling custom route exports to allow transitive communication across all consumer networks.
  3. Provision a Private Service Connect (PSC) endpoint in each Consumer VPC that targets the published Service Attachment URI.Cevap
  4. D
    Establish Cloud HA VPN tunnels between each Consumer VPC and the Producer VPC to translate overlapping IP subnets using NAT gateways.
  5. E
    Grant the primitive IAM Owner role to consumer service accounts on the Producer project to automatically expose load balancer endpoints across project perimeters.

Cevap

To allow consumer VPCs with overlapping IP address ranges to securely access an internal service in a producer VPC without establishing VPC Network Peering or IP routing, you must create a Service Attachment pointing to the Producer VPC's Internal HTTP(S) Load Balancer forwarding rule, and deploy a Private Service Connect (PSC) endpoint in each Consumer VPC targeting the URI of that Service Attachment.
Private Service Connect allows private consumption of services across GCP projects even when VPCs have overlapping IP address spaces. Creating a Service Attachment in the producer VPC exposes the internal load balancer's forwarding rule via a NAT subnet. Provisioning a Private Service Connect endpoint in the consumer VPC allocates an internal IP address within the consumer's local subnet, establishing one-way private connectivity to the producer service.

Adım Adım Çözüm

1
Identify connectivity constraints across VPC boundaries
Recognize that overlapping IP space and isolation requirements preclude using VPC Network Peering or direct IP routing.
VPC Network Peering requires non-overlapping IP ranges and does not support transitive routing.
2
Publish the internal service in the producer VPC
Configure a Private Service Connect Service Attachment referencing the Producer VPC's internal load balancer forwarding rule and designated NAT subnet.
The Service Attachment acts as the published gateway that consumer endpoints connect to.
3
Consume the published service from consumer VPCs
Provision a Private Service Connect endpoint in each Consumer VPC using an IP address from the consumer's own local subnet targeting the Service Attachment URI.
This translates consumer traffic locally to the producer service via NAT without exposing consumer IP addresses or establishing network peering.

Anahtar Kavram

Private Service Connect (PSC) for Published Services
Bu soruyu puanla

Konular

Configuring Network Topology and VPC Infrastructure

Bu konudan daha fazla soru