Designing network, storage, and compute resources

Harlow Group has eight application teams, each with its own Google Cloud project. The central network team must own all subnets, firewall rules, routes, and the Cloud Interconnect attachments, while application teams must be able to deploy VMs and GKE clusters into subnets they are given. Workloads in different team projects must talk to each other using internal IP addresses without extra network hops.

Which network design should you recommend?

1. ACreate a VPC network in each team project and connect them all with VPC Network PeeringSeparate peered networks leave each team owning its own subnets, routes, and firewall rules, which conflicts with the requirement that the central network team owns them.
2. BCreate a Shared VPC in a host project owned by the network team, attach the eight team projects as service projects, and grant each team the Compute Network User role on its subnetsShared VPC keeps network control in the host project while service projects deploy into shared subnets, and all workloads share one VPC network for direct internal communication.
3. CCreate a VPC network in each team project and connect them with HA VPN tunnelsVPN between VPC networks adds tunnels, cost, and bandwidth limits, and it still leaves network control with each team.
4. DPut all eight teams' workloads into one project with a single VPC networkOne project removes the separation of billing, quotas, and IAM that per-team projects provide.

Lumenrise Utilities is building a platform for 30 million smart meters that each report a reading every 15 seconds, which is about 2 million writes per second. The customer app looks up a single meter's readings for a time range with single-digit millisecond latency, and data scientists run occasional large analytical scans. The data has no need for joins or multi-row transactions.

Which database should you recommend for the meter readings?

1. ABigtable with a row key that combines the meter ID and a timestampBigtable scales linearly to millions of writes per second, serves key and key-range lookups in single-digit milliseconds, and a meter ID plus timestamp row key makes time-range reads for one meter efficient.
2. BBigQuery tables partitioned by dayBigQuery is excellent for the analytical scans, but it is not designed for single-digit millisecond lookups serving a customer app.
3. CCloud SQL for PostgreSQL with read replicasCloud SQL is a single-primary relational database that cannot absorb 2 million writes per second.
4. DFirestore in Native mode with one document per readingFirestore suits mobile and web application data, but sustained write rates of this size against sequential keys run into hotspotting and cost far more than Bigtable.

Tidewell Software sells a fraud-scoring API that runs behind an internal passthrough Network Load Balancer in its own VPC network. Forty enterprise customers want to call the API privately from their own Google Cloud VPC networks. Many customers use the same 10.0.0.0/8 ranges that Tidewell uses, Tidewell must not gain any network access to customer networks, and each customer must be approved before it can connect.

Which design should you recommend?

1. ASet up VPC Network Peering between Tidewell's network and each customer networkPeering fails when subnet ranges overlap, and it exposes whole networks to each other rather than a single service.
2. BAdd every customer project as a service project of a Shared VPC hosted by TidewellShared VPC is for projects inside one organization's administrative control, not for separate customer companies, and it would give customers access to Tidewell's network.
3. CPublish the service with a Private Service Connect service attachment that requires explicit project approval, and have each customer create a Private Service Connect endpoint in its own VPC networkPrivate Service Connect exposes only the service through an endpoint IP address in the consumer's own network, works with overlapping IP ranges, is unidirectional, and supports accept lists for approving consumers.
4. DExpose the API through Cloud NAT so that customers reach it on a public IP addressCloud NAT provides outbound internet access for private resources; it does not publish inbound services, and the traffic would not be private.

Fairhollow Press receives manuscript files from authors. Each time a file is uploaded to a Cloud Storage bucket, a short piece of Python code must extract metadata and write it to Firestore, which takes under 10 seconds. Uploads happen a few hundred times a day, and the team wants to pay nothing when there are no uploads and manage no servers or containers.

Which compute option should you recommend?

1. AA GKE Autopilot cluster running a Deployment that polls the bucketAutopilot removes node management but still requires container images and Kubernetes manifests, and a polling Deployment runs even when there are no uploads.
2. BA Cloud Run functions function triggered by the Cloud Storage object finalized event through EventarcCloud Run functions runs a single function from source code in response to events such as Cloud Storage uploads, scales to zero, and needs no container or server management.
3. CA Compute Engine VM with a cron job that checks the bucket every minuteA VM bills while idle and leaves the team to patch the operating system, which the scenario rules out.
4. DA Dataflow streaming pipeline that reads bucket notificationsDataflow is built for large-scale data processing and keeps workers running, which is costly and excessive for a few hundred small events a day.