Examkin

Soru

Zorluk: OrtaConfiguring Network Topology and VPC Infrastructure

An enterprise architecture team is configuring network connectivity between an on-premises data center, a Shared VPC host project acting as a consumer network, and an isolated producer VPC network hosting an internal microservices application. On-premises systems connected via Dedicated Interconnect and Compute Engine workloads residing in service projects attached to the Shared VPC must securely access the producer application. Transitive network routing must not be configured, and overlapping IP ranges between the producer and consumer networks must be tolerated. Which TWO configuration steps should the cloud architect implement to fulfill these requirements? (Select TWO.)

  1. Provision a Private Service Connect (PSC) endpoint in the consumer Shared VPC that references a Service Attachment created in the producer VPC network.Cevap
  2. B
    Establish a VPC Network Peering connection between the consumer Shared VPC and the producer VPC, and rely on custom route exports to forward on-premises traffic through the peering link.
  3. Configure custom BGP route advertisements on the consumer Shared VPC Cloud Router to advertise the Private Service Connect endpoint IP address range to the on-premises router over Cloud Interconnect.Cevap
  4. D
    Replace the Dedicated Interconnect with an HA Cloud VPN setup using static routes to reduce latency and handle cross-VPC throughput requirements.
  5. E
    Remove IAM authentication requirements from the producer service endpoint and depend exclusively on VPC Firewall rules to prevent data exfiltration.

Cevap

The correct architecture requires provisioning a Private Service Connect (PSC) endpoint in the consumer Shared VPC linked to the producer Service Attachment, and configuring custom BGP route advertisements on the consumer Cloud Router to announce the PSC endpoint IP range to on-premises networks.
Private Service Connect (PSC) allows private access to producer services without VPC Peering, avoiding transitive routing constraints and accommodating overlapping CIDR ranges. To allow on-premises systems connected via Dedicated Interconnect to access the PSC endpoint in the consumer VPC, the Cloud Router in the consumer VPC must advertise the PSC endpoint's IP address range via BGP custom route advertisements.

Adım Adım Çözüm

1
Select Private Service Connect for cross-VPC service publishing without peering transitivity
Establishes unilateral private access to the producer service using an internal consumer IP address while preventing full network exposure and resolving overlapping IP constraints via NAT.
VPC Network Peering is non-transitive and cannot forward on-premises traffic through peering links.
2
Configure custom BGP route advertisement on the Cloud Router managing Dedicated Interconnect BGP sessions
Advertises the IP address of the PSC endpoint to the on-premises router over BGP.
By default, Cloud Router advertises subnet IP ranges; explicit custom route advertisements are required so on-premises networks learn the path to PSC endpoint IPs.

Anahtar Kavram

Private Service Connect and Hybrid Route Advertisements
Bu soruyu puanla

Konular

Configuring Network Topology and VPC Infrastructure

Bu konudan daha fazla soru