Configuring network topologies

Meridian Retail Group has 14 VPC networks in separate projects owned by different business units, and two to three new VPCs are added every quarter. Every VPC must be able to reach every other VPC privately, and an existing HA VPN connection to the company's data center must be reachable from all of them. The platform team wants one central place to manage this connectivity and wants to minimize administrative effort as the number of VPCs grows.

What should you implement?

1. AA full mesh of VPC Network Peering connections between all 14 VPCs, with custom route export enabled on each peeringPeering is non-transitive and must be configured pairwise, so the number of peerings grows quadratically and every new VPC requires changes in every existing project, which contradicts the minimal-effort goal.
2. BA Shared VPC host project that every business unit migrates its workloads intoShared VPC centralizes one network for many service projects, but it requires re-creating the business units' existing VPCs and workloads rather than connecting the VPCs they already own.
3. CA Network Connectivity Center hub with each VPC attached as a VPC spoke and the HA VPN tunnels attached as a hybrid spokeNetwork Connectivity Center provides a hub-and-spoke model with transitive connectivity among VPC spokes and hybrid spokes, managed in one place; adding a VPC means adding one spoke.
4. DAn HA VPN connection between each pair of VPCs, with Cloud Router BGP sessions on every tunnelVPC-to-VPC HA VPN works but needs a gateway pair and BGP sessions for every pair of networks, adding cost and the same quadratic configuration effort as peering.

Halcyon Health runs patient-facing services on Compute Engine in a VPC named care-vpc in us-central1. An audit finding requires inline detection and blocking of known exploits and malware in traffic between internal application tiers and in traffic to the internet, not just alerts. The security team wants to manage this with Google Cloud firewall policies rather than deploying third-party appliances.

What should you configure?

1. AA Google Cloud Armor security policy with preconfigured WAF rules attached to the backend services of the load balancerCloud Armor protects traffic arriving at supported load balancers, so it does not inspect east-west traffic between internal tiers or egress traffic to the internet.
2. BPacket Mirroring of care-vpc traffic to a Cloud IDS endpointCloud IDS analyzes mirrored copies of traffic and raises threat findings, but it is out of band and cannot block the traffic, which the audit requires.
3. CCloud NGFW Standard firewall policy rules that use FQDN objects and Google Threat Intelligence listsCloud NGFW Standard features filter traffic by addresses, domains, and threat intelligence lists, but they do not perform intrusion prevention or inspect payloads for exploits and malware.
4. DCloud NGFW Enterprise firewall endpoints associated with care-vpc, a threat prevention security profile group, and firewall policy rules that apply that security profile groupCloud NGFW Enterprise provides the intrusion prevention service: firewall policy rules send matching traffic to a zonal firewall endpoint that inspects it with the threat prevention profile and can block it inline.

Pinecrest Analytics runs batch workers on Compute Engine in subnet workers-subnet of a custom-mode VPC in europe-west1. A security policy forbids external IP addresses on any VM. The workers must read files from Cloud Storage and write results to BigQuery, and they must download software packages from a vendor repository on the public internet.

Which two actions should you perform? Each correct answer presents part of the solution.

1. AEnable Private Google Access on workers-subnetPrivate Google Access lets VMs with only internal IP addresses reach Google APIs and services such as Cloud Storage and BigQuery.
2. BCreate a Cloud NAT gateway on a Cloud Router in europe-west1 that serves workers-subnetCloud NAT provides outbound internet access for VMs without external IP addresses, which is needed to reach the vendor's public repository.
3. CConfigure private services access by allocating an IP range and peering the VPC with the service producer networkPrivate services access connects to producer-managed services such as Cloud SQL or Memorystore over internal IPs; it is not how VMs reach Cloud Storage and BigQuery APIs.
4. DCreate a Serverless VPC Access connector in europe-west1Serverless VPC Access connectors let serverless services send traffic into a VPC; they do not give VMs access to Google APIs or the internet.
5. EAdd an egress firewall rule that allows traffic to 0.0.0.0/0 on TCP 443VPC networks already have an implied allow-egress rule, and a firewall rule does not provide the address translation that VMs without external IPs need to reach the internet.

Larkfield Credit Union connects its Columbus data center to a VPC named core-vpc in us-east4 with a Classic VPN tunnel that uses static routes. The data center has two redundant VPN appliances, each with its own public IP address. The network team adds new on-premises subnets every few weeks and currently has to update static routes by hand. The business now requires a 99.99 percent availability SLA for the VPN connection and automatic route exchange.

What should you configure?

1. AAn HA VPN gateway in us-east4 with tunnels from both of its interfaces to the two on-premises appliances, and a Cloud Router with a BGP session on each tunnelHA VPN with tunnels on both gateway interfaces meets the documented 99.99 percent SLA configuration, and HA VPN requires dynamic routing through Cloud Router, so new on-premises subnets are learned over BGP without manual route changes.
2. BA second Classic VPN gateway in us-east4 with one tunnel to each on-premises appliance and static routes for every on-premises subnetClassic VPN carries a 99.9 percent SLA regardless of the number of gateways, and static routes keep the manual route maintenance the team wants to remove.
3. CAn HA VPN gateway in us-east4 with a single tunnel from interface 0 to one appliance and a Cloud Router BGP session on that tunnelBGP removes manual routing, but a single tunnel from one interface does not meet the 99.99 percent SLA requirements, which need tunnels on both HA VPN interfaces.
4. DA Partner Interconnect VLAN attachment through a single service provider connection, with static routes configured on the provider's routerA single Partner Interconnect attachment does not reach a 99.99 percent topology, and Partner Interconnect exchanges routes with Cloud Router over BGP rather than relying on static routes at the provider.