Examkin

Soru

Zorluk: ZorConfiguring Network Topology and VPC Infrastructure

An enterprise is configuring its Google Cloud network topology to support multi-region workloads with strict security and network connectivity constraints. Workload instances deployed in private subnets must access Google Cloud APIs securely without requiring external IP addresses, and potential data exfiltration to external Cloud Storage buckets must be blocked using perimeter-level security controls rather than user IAM permissions alone. Furthermore, the architecture utilizes a hub-and-spoke topology across multiple VPC networks where direct communication between spoke VPCs is required. Which TWO network topology and configuration choices must the cloud architect implement to satisfy these requirements?

  1. Enable Private Google Access on all internal subnets and configure a VPC Service Controls perimeter encompassing the workload projects to restrict API access boundaries.Cevap
  2. Establish direct VPC Network Peering connections between any pair of spoke VPCs that require inter-spoke communication, rather than attempting to route traffic through the hub VPC.Cevap
  3. C
    Configure default routes in spoke VPCs to forward inter-spoke traffic through existing hub VPC Peering connections, expecting the hub VPC to transitively forward packets to destination spokes.
  4. D
    Rely strictly on fine-grained IAM primitive and predefined storage roles to prevent compromised compute instances from copying sensitive objects to external Cloud Storage buckets.
  5. E
    Deploy HA VPN tunnels with static routing as the primary connectivity solution for workloads requiring sustained 20 Gbps low-latency inter-VPC and hybrid interconnectivity.

Cevap

The cloud architect must enable Private Google Access with VPC Service Controls for API routing and data exfiltration defense, and establish direct VPC Network Peering between spoke VPCs due to non-transitive VPC Peering rules.
Enabling Private Google Access on subnets permits private instances to reach Google services natively. Layering VPC Service Controls creates a security perimeter that prevents authorized credentials from exfiltrating data to external storage resources. Furthermore, because GCP VPC Network Peering is non-transitive, direct VPC Peering between spoke networks is necessary to enable communication between spokes.

Adım Adım Çözüm

1
Analyze API access and data exfiltration requirements
Private Google Access provides IP routing to Google APIs for instances without external IPs, while VPC Service Controls provides perimeter isolation to prevent exfiltration to external resources.
IAM rules alone cannot prevent data copies to external buckets outside the organization perimeter.
2
Analyze inter-VPC spoke routing requirements
Direct VPC Peering between spokes must be configured.
Google Cloud VPC Network Peering is non-transitive, meaning VPC A peered to VPC B cannot reach VPC C peered to VPC B without direct peering between A and C.

Anahtar Kavram

VPC Network Peering Non-Transitivity and Private Access Perimeter Security
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Configuring Network Topology and VPC Infrastructure

Bu konudan daha fazla soru