Google Professional Cloud Network Engineer Question 209
Single answerGoogle Cloud PlatformYour company has multiple teams working on different projects, and each team requires its own isolated network environment in Google Cloud. You need to configure Virtual Private Clouds (VPCs) to meet the following requirements:
- Each team should only have network access to their resources.
- The solutions must optimize cost by minimizing the number of public IP addresses allocated.
- Some teams will require communication between their VPCs for shared services.
Which configuration approach should you choose to meet these requirements?
- A
Create a single VPC for all teams, use subnet-level IAM policies for isolation, and configure Cloud NAT for internet access.
- B
Create a separate VPC for each team, enable VPC Network Peering for shared services, and configure Cloud NAT for internet access.
- C
Create a single VPC with multiple subnets, allocate public IPs to all VM instances, and use firewall rules for access control.
- D
Create one VPC per team, use Shared VPC to provide shared services, and configure external IP addresses for all instances.
Show answer and explanation
Correct answer: B
Explanation
The correct answer is to create separate VPCs for each team, ensuring proper isolation, then enable VPC Network Peering to facilitate communication for shared services. Using Cloud NAT allows teams to access the internet without requiring public IPs for each VM, optimizing costs. This approach fulfills all the stated requirements effectively.
- A. Incorrect.
While this option uses a single VPC and Cloud NAT to minimize public IP addresses, it does not provide sufficient isolation between teams, as subnet-level IAM policies cannot fully isolate resources.
- B. Correct.
This option meets all requirements by creating separate VPCs for team isolation, using VPC Network Peering for shared services, and leveraging Cloud NAT to optimize costs by minimizing public IP usage.
- C. Incorrect.
This option fails to meet the cost-optimization requirement as it allocates public IPs to all VM instances. It also lacks proper isolation for teams as everything resides in a single VPC.
- D. Incorrect.
This option provides team isolation through separate VPCs but does not optimize costs since external IPs are allocated to all instances. Additionally, Shared VPC is not necessary for meeting the shared services requirement in this scenario.