Google Professional Cloud Network Engineer Question 105
Select 3Google Cloud PlatformYou are tasked with integrating a third-party network virtual appliance (NVA) for inspecting all outbound traffic from a subnet in a Google Cloud VPC. To ensure traffic passes through the NVA, you need to configure custom routing. Which steps should you take to achieve this?
- A
Create a static route with the default internet gateway as the next hop for outbound traffic.
- B
Create a static route with the next hop set to the internal IP address of the NVA instance.
- C
Create a route table with a route priority lower than the default route priority for traffic redirection.
- D
Ensure the NVA is deployed in the same VPC and region as the subnet it will inspect.
- E
Enable IP Forwarding on the NVA instance to allow traffic to be routed through it.
Show answer and explanation
Correct answers: B, D, E
Explanation
To insert a third-party network virtual appliance (NVA) into your network for traffic inspection, you must configure a static route that directs traffic to the NVA's IP address. The NVA must also be deployed in the same VPC and region as the subnet to ensure proper routing. Additionally, enabling IP Forwarding on the NVA is critical to allow it to forward traffic after inspection. Failing to configure these steps will result in traffic bypassing the NVA or being dropped.
- A. Incorrect.
This is incorrect because using the default internet gateway as the next hop will bypass the NVA entirely, and traffic will not be inspected as intended.
- B. Correct.
This is correct because you need to define a custom static route that directs traffic to the NVA instance's internal IP to ensure inspection.
- C. Incorrect.
This is incorrect because route priority does not determine traffic redirection in this scenario. Instead, custom routes must explicitly define the next hop.
- D. Correct.
This is correct because the NVA must reside in the same VPC and region to ensure proper routing and communication with the subnet it is inspecting.
- E. Correct.
This is correct because enabling IP Forwarding on the NVA instance is required to allow traffic to pass through and be inspected before being forwarded to its destination.