Google Professional Cloud Network Engineer Question 265
Single answerGoogle Cloud PlatformYour organization has a hybrid cloud setup with workloads running in both Google Cloud and an on-premises data center. The on-premises environment connects to Google Cloud via a VPN gateway, and you want to route all traffic destined for a specific external IP range (e.g., 203.0.113.0/24) through the on-premises data center instead of the default internet egress. How can you achieve this using Policy-based Routing (PBR) in Google Cloud?
- A
Create a route in Google Cloud with a higher priority than the default route, specifying 203.0.113.0/24 as the destination and the VPN tunnel interface as the next hop.
- B
Configure a firewall rule to deny all egress traffic to 203.0.113.0/24 and rely on the VPN to automatically route traffic through the on-premises data center.
- C
Set up a Policy-based Routing rule using a Virtual Private Cloud (VPC) network route, specifying source IP ranges and destination IP ranges, and set the next hop as the VPN tunnel.
- D
Use Cloud NAT to configure the routing policy for 203.0.113.0/24 to direct traffic through the on-premises environment.
Show answer and explanation
Correct answer: C
Explanation
Policy-based Routing (PBR) in Google Cloud enables custom routing rules based on specific traffic criteria, such as source and destination IP ranges. In this scenario, setting up a Policy-based Routing rule ensures that traffic destined for 203.0.113.0/24 is routed through the on-premises data center via the VPN tunnel, meeting the requirement. Other options either misunderstand the use of PBR or involve tools that are not suited for this purpose.
- A. Incorrect.
Incorrect. While creating a route with a higher priority is part of traditional routing, Policy-based Routing (PBR) requires setting up more granular rules, such as source and destination criteria, which is not achieved by this option.
- B. Incorrect.
Incorrect. Firewall rules control which traffic is allowed or denied, but they do not determine the next hop for routing traffic. This does not achieve the goal of routing traffic through the on-premises data center.
- C. Correct.
Correct. Policy-based Routing allows you to define routing rules based on specific criteria, such as source IP ranges and destination IP ranges. By creating a PBR rule and specifying the VPN tunnel as the next hop, you ensure traffic destined for 203.0.113.0/24 is routed through the on-premises data center.
- D. Incorrect.
Incorrect. Cloud NAT is used for providing external internet access to resources in private subnets but does not support custom routing policies like Policy-based Routing.