Google Professional Cloud Network Engineer Question 104
Select 2Google Cloud PlatformYour organization uses a third-party network virtual appliance (NVA) hosted in a dedicated subnet in Google Cloud. This NVA is intended to inspect all egress traffic from your workloads in a VPC. How should you configure custom routes to ensure that all outgoing traffic from the workloads is inspected by the NVA before reaching the internet?
- A
Create a static route in the VPC that directs all 0.0.0.0/0 traffic to the NVA's internal IP as the next hop.
- B
Configure a policy-based route to ensure only specific traffic destined for the internet is routed to the NVA.
- C
Create a static route with a lower priority to bypass the NVA for internal VPC traffic.
- D
Use a static route to direct all internet-bound traffic to the default internet gateway instead of the NVA.
- E
Add a route to the VPC that ensures traffic from the NVA can reach the internet.
Show answer and explanation
Correct answers: A, E
Explanation
To ensure all outgoing traffic is inspected by a third-party network virtual appliance (NVA), a static route should be created to forward all traffic destined for external networks (0.0.0.0/0) to the NVA’s internal IP as the next hop. Additionally, the NVA itself must have a route to the internet to forward traffic after inspection. This setup ensures traffic inspection while maintaining proper routing functionality.
- A. Correct.
Correct: This ensures all internet-bound traffic is directed to the NVA for inspection before it is routed to its destination.
- B. Incorrect.
Incorrect: Policy-based routing is not required in this case; static routing is sufficient to redirect all traffic to the NVA.
- C. Incorrect.
Incorrect: Internal VPC traffic does not need to bypass the NVA in this scenario as the focus is on egress traffic inspection.
- D. Incorrect.
Incorrect: This bypasses the NVA entirely, defeating the purpose of inspection for outgoing traffic.
- E. Correct.
Correct: Once the traffic is inspected by the NVA, it must have a route to the internet; otherwise, it will be dropped.