Examkin

Soru

Zorluk: ZorConfiguring Network Topology and VPC Infrastructure

An enterprise organization maintains a central Hub VPC network connected to an on-premises data center using Dedicated Cloud Interconnect with Cloud Router dynamic routing. The architecture team provisions two new isolated workloads in Spoke-1 VPC and Spoke-2 VPC, both of which are connected to the central Hub VPC using VPC Network Peering. The application team requires direct private connectivity between Spoke-1 VPC and Spoke-2 VPC, as well as two-way routing between both Spoke VPCs and the on-premises network. Which TWO architectural modifications must be implemented to fulfill these requirements without introducing virtual routing appliances? (Select TWO.)

  1. Create a direct VPC Network Peering connection between Spoke-1 VPC and Spoke-2 VPC.Cevap
  2. Enable custom route import and export on the VPC Network Peering connections between the central Hub VPC and each Spoke VPC.Cevap
  3. C
    Configure the existing VPC Network Peering connections between Spoke-1 VPC, Hub VPC, and Spoke-2 VPC to operate in transitive routing mode.
  4. D
    Replace the Dedicated Cloud Interconnect with HA Cloud VPN tunnels between on-premises and each Spoke VPC to automatically bypass Hub routing restrictions.
  5. E
    Deploy a single VPC Service Controls perimeter encompassing Spoke-1 VPC, Spoke-2 VPC, and Hub VPC to allow network traffic flow across perimeters.

Cevap

Establish a direct VPC Network Peering connection between Spoke-1 VPC and Spoke-2 VPC, and enable custom route import/export on the VPC Network Peering connections between the central Hub VPC and each Spoke VPC.
VPC Network Peering in Google Cloud is strictly non-transitive. To enable direct private communication between Spoke-1 VPC and Spoke-2 VPC, a direct peering link must be established between them. Additionally, to extend on-premises connectivity from the Hub VPC's Cloud Interconnect to the spokes, custom routes must be exported from the Hub VPC peering connection and imported by the Spoke VPC peering connections.

Adım Adım Çözüm

1
Evaluate inter-spoke routing constraints under GCP networking rules.
Recognize that VPC Network Peering is non-transitive, meaning Spoke-1 cannot communicate with Spoke-2 via the Hub VPC.
Direct peering between Spoke-1 VPC and Spoke-2 VPC must be configured to allow low-latency, private inter-spoke traffic.
2
Determine how on-premises routes learned by Cloud Router in the Hub VPC can be extended to spoke VPC networks.
Identify that custom route export must be enabled on the Hub VPC peering side and custom route import on the Spoke VPC peering sides.
Importing and exporting custom routes allows the BGP-learned on-premises routes to propagate dynamically across peered networks without extra routing appliances.

Anahtar Kavram

VPC Network Peering Non-Transitivity and Custom Route Exchange
Bu soruyu puanla

Konular

Configuring Network Topology and VPC Infrastructure

Bu konudan daha fazla soru