Google Professional Cloud Network Engineer Question 101
Select 2Google Cloud PlatformYou are designing a Google Cloud network to route traffic through a third-party network virtual appliance (NVA) for inspection and filtering. The appliance is deployed in its own subnet, and you must ensure that all egress traffic from your application VMs is routed through the NVA. Which steps should you take to achieve this?
- A
Create a static route with the next hop set to the NVA’s internal IP address.
- B
Create a VPC firewall rule to deny all egress traffic except traffic destined for the NVA.
- C
Use a policy-based route to direct all traffic from the application VMs' subnet to the NVA.
- D
Enable IP forwarding on the NVA's VM instance to allow packet processing.
- E
Attach a custom route advertisement to the NVA subnet to propagate the route.
Show answer and explanation
Correct answers: A, D
Explanation
To route traffic through a third-party NVA, you must create a static route that directs traffic to the NVA's internal IP address and enable IP forwarding on the NVA to allow it to process and forward packets. Policy-based routing is not supported, and firewall rules or route advertisements alone are insufficient to meet the requirement.
- A. Correct.
Correct: A static route with the next hop set to the NVA's internal IP ensures that traffic from your application VMs is directed to the NVA for inspection.
- B. Incorrect.
Incorrect: Firewall rules control access but do not define how traffic is routed. This step is not sufficient for routing traffic through the NVA.
- C. Incorrect.
Incorrect: Policy-based routing is not currently supported in Google Cloud. Static routes must be used instead.
- D. Correct.
Correct: Enabling IP forwarding on the NVA's VM instance ensures that the appliance can process and forward packets as expected.
- E. Incorrect.
Incorrect: Route advertisements are used for dynamic routing scenarios with hybrid or multi-cloud setups, not for directing traffic to an NVA within the same VPC.