Google Professional Cloud Network Engineer Question 11
Single answerGoogle Cloud PlatformYour organization is migrating its on-premises workloads to Google Cloud. The on-premises environment uses an internal DNS server for name resolution of private resources, while public domain names are resolved through an external DNS provider. The organization wants to implement a hybrid DNS topology where private resources in Google Cloud and on-premises can be resolved seamlessly, without exposing internal DNS data to the public internet. How should you design the DNS topology to meet these requirements?
- A
Use Cloud DNS Private Zone for private resources in Google Cloud, configure DNS peering for name resolution between Cloud DNS and the on-premises DNS server, and use a public DNS zone for public domain resolution.
- B
Use Cloud DNS Public Zone for all DNS records (private and public) and update the on-premises DNS server to forward all queries to Cloud DNS.
- C
Use Cloud DNS Private Zone for private resources in Google Cloud, configure a Cloud VPN or Interconnect to forward private DNS queries to the on-premises DNS server, and use a public DNS zone for public domain resolution.
- D
Use a single Cloud DNS Public Zone to manage both public and private DNS records, and configure on-premises DNS to forward all queries to that zone.
Show answer and explanation
Correct answer: A
Explanation
The correct design for this scenario uses a Cloud DNS Private Zone for private resources in Google Cloud, ensuring they remain internal and secure. Setting up DNS peering allows seamless resolution between Google Cloud and the on-premises DNS server. Public DNS resolution is handled separately using a public DNS zone, meeting the requirement to resolve public domain names without interfering with the internal DNS setup.
- A. Correct.
This is the correct approach. Using a Cloud DNS Private Zone for private resources ensures internal DNS data remains private. Configuring DNS peering allows seamless name resolution between Google Cloud and the on-premises DNS server. Public domain resolution is handled separately by a public DNS zone.
- B. Incorrect.
This is incorrect because a Cloud DNS Public Zone is not suitable for private DNS records. Public zones expose DNS records to the internet, which violates the requirement to keep internal DNS data private.
- C. Incorrect.
This is partially correct but not optimal. Forwarding all private DNS queries to the on-premises DNS server through a Cloud VPN or Interconnect can introduce latency and create a single point of failure for DNS resolution in Google Cloud.
- D. Incorrect.
This is incorrect because combining public and private DNS records in a single Cloud DNS Public Zone exposes internal DNS data to the public internet, which violates the security requirements.