Google Professional Cloud Network Engineer Question 239
Select 2Google Cloud PlatformYour organization has set up a VPC with multiple subnets and a custom route table. You need to configure routing to ensure that traffic from a private subnet (10.1.0.0/24) can reach an on-premises network (192.168.0.0/16) through a VPN gateway. Which of the following is required to configure the VPC routing correctly?
- A
Add a route to the custom route table with a destination of 192.168.0.0/16 and next hop as the VPN gateway.
- B
Add a route to the default route table with a destination of 10.1.0.0/24 and next hop as the Internet gateway.
- C
Ensure the on-premises network has a route back to the 10.1.0.0/24 subnet through the VPN.
- D
Enable Private Google Access on the 10.1.0.0/24 subnet.
- E
Add a route to the custom route table with a destination of 0.0.0.0/0 and next hop as the VPN gateway.
Show answer and explanation
Correct answers: A, C
Explanation
To configure VPC routing for communication with an on-premises network through a VPN gateway, you must ensure the VPC route table directs traffic for the desired destination (192.168.0.0/16) to the VPN gateway. Additionally, bidirectional communication requires the on-premises network to have a route back to the VPC's private subnet (10.1.0.0/24). Other options, such as enabling Private Google Access or adding unnecessary routes, are not relevant to this use case.
- A. Correct.
Correct: You need to add a route in the custom route table of the VPC so traffic destined for the on-premises network (192.168.0.0/16) is sent through the VPN gateway.
- B. Incorrect.
Incorrect: Traffic from the private subnet does not need to go to the Internet gateway, and adding this route would not help in routing traffic to the on-premises network.
- C. Correct.
Correct: A route back from the on-premises network to the private subnet (10.1.0.0/24) is necessary for bidirectional communication.
- D. Incorrect.
Incorrect: While enabling Private Google Access is useful for accessing Google APIs from private subnets, it is not relevant for routing traffic to an on-premises network through a VPN.
- E. Incorrect.
Incorrect: Adding a default route (0.0.0.0/0) to the VPN gateway would route all traffic, including Internet traffic, through the VPN, which is not required in this scenario.