Google Professional Cloud Network Engineer Question 153
Single answerGoogle Cloud PlatformYou are a Cloud Network Engineer for a company that has multiple GCP projects. Your team is setting up a new application that needs to access a Google-managed service, such as Cloud SQL, from a private IP address in a different VPC. The application resides in a VPC that is peered with another VPC hosting the Google-managed service. However, the application cannot connect to the service using its private IP. What is the most likely reason for this issue?
- A
VPC Network Peering does not support transitive routing.
- B
Private services access has not been enabled in the VPC hosting the Google-managed service.
- C
The correct firewall rules are not configured to allow traffic between the application and the Google-managed service.
- D
The Service Networking API has not been enabled in the project hosting the Google-managed service.
Show answer and explanation
Correct answer: A
Explanation
VPC Network Peering does not support transitive routing, meaning that traffic between two VPCs and a Google-managed service must be explicitly configured. For the Google-managed service to be accessible via private IP, private services access must be configured in the VPC where the service resides. This allows a private IP range to be allocated for the service, ensuring proper connectivity.
- A. Correct.
VPC Network Peering does not support transitive routing, which means that traffic cannot flow from the application VPC to the VPC hosting the Google-managed service via the peered VPC. Each VPC must have private services access configured independently.
- B. Incorrect.
Private services access is required to allocate a private IP range for the Google-managed service. Without this, the service cannot be accessed via private IP, even if VPC Network Peering is in place.
- C. Incorrect.
While firewall rules are important, they are not the root cause in this scenario. The issue lies in the lack of private services access configuration.
- D. Incorrect.
The Service Networking API is required to set up private services access but is not the root cause of the issue described. The lack of private services access is the primary issue.