Google Professional Cloud Network Engineer Question 103
Select 3Google Cloud PlatformYour company has deployed a third-party network virtual appliance (NVA) in a specific subnet of your Google Cloud VPC to inspect traffic between on-premises systems and workloads hosted in Google Cloud. To achieve this, you need to ensure that traffic between the on-premises network and the Google Cloud workloads traverses the NVA. How should you configure custom routes to meet this requirement?
- A
Create a custom static route to forward traffic from the on-premises network to the NVA’s internal IP address as the next hop.
- B
Configure policy-based routing to redirect traffic from the Google Cloud workloads to the NVA based on source IP ranges.
- C
Set up a route with the NVA's IP as the destination and the default internet gateway as the next hop.
- D
Create a custom static route in the VPC to forward traffic from the NVA to the on-premises network using the Cloud VPN gateway as the next hop.
- E
Configure a default route with the NVA as the next hop for all outbound traffic in the VPC.
Show answer and explanation
Correct answers: A, B, D
Explanation
To successfully insert a third-party network virtual appliance (NVA) for traffic inspection, you must plan custom routes carefully. A custom static route is required to direct traffic from on-premises to the NVA, along with policy-based routing to redirect traffic from Google Cloud workloads to the NVA based on source IP ranges. Lastly, a custom static route is needed to forward traffic from the NVA back to the on-premises network through the Cloud VPN gateway. These configurations ensure that traffic flows through the NVA as required while avoiding unnecessary routing of all outbound traffic to the NVA.
- A. Correct.
This is correct because a custom static route is needed to direct traffic from the on-premises network to the NVA, specifying the NVA's internal IP address as the next hop ensures that traffic is appropriately routed.
- B. Correct.
This is correct because policy-based routing allows you to redirect traffic from specific sources (e.g., Google Cloud workloads) to the NVA for inspection based on source IP ranges.
- C. Incorrect.
This is incorrect because the NVA is not intended to directly communicate with the internet gateway in this scenario. The NVA is used to inspect traffic between on-premises and Google Cloud workloads, not handle internet-bound traffic.
- D. Correct.
This is correct because a custom static route ensures that traffic inspected by the NVA can be forwarded back to the on-premises network via the Cloud VPN gateway.
- E. Incorrect.
This is incorrect because configuring a default route with the NVA as the next hop would unintentionally redirect all outbound traffic in the VPC to the NVA, which is not aligned with the scenario's requirements.