Google Professional Cloud Network Engineer Question 268
Single answerGoogle Cloud PlatformYou are managing a Google Cloud environment with multiple Virtual Machine (VM) instances running in a custom VPC network. One of your VMs (VM-A) requires traffic destined for an external partner network (203.0.113.0/24) to be routed through a specific next-hop VM (VM-B) for inspection. Other traffic from VM-A should continue to use the default internet gateway. How can you achieve this using Policy-based Routing (PBR)?
- A
Create a route in the VPC network with the destination 203.0.113.0/24 and specify the next hop as VM-B.
- B
Configure a firewall rule to redirect traffic from VM-A to VM-B for the destination 203.0.113.0/24.
- C
Create a policy-based route for VM-A with a match condition for the destination 203.0.113.0/24 and specify VM-B as the next hop.
- D
Use a NAT gateway to route traffic from VM-A to VM-B for the destination 203.0.113.0/24.
Show answer and explanation
Correct answer: C
Explanation
Policy-based routing (PBR) in Google Cloud enables you to define custom routing rules based on specific traffic conditions, such as source, destination, and protocol. In this scenario, you can configure a policy-based route to match traffic from VM-A destined for 203.0.113.0/24 and route it through VM-B as the next hop. This ensures that only the intended traffic is inspected by VM-B, while other traffic from VM-A continues to use the default internet gateway.
- A. Incorrect.
This option describes a standard VPC route, but it does not fulfill the requirement for policy-based routing. A standard route cannot target traffic from a specific VM for a specific destination.
- B. Incorrect.
Firewall rules in Google Cloud are used to allow or deny traffic but cannot be used to redirect traffic to a specific next hop, so this is incorrect.
- C. Correct.
This is the correct option. Policy-based routing allows you to create a route that matches specific traffic conditions, such as traffic from VM-A to 203.0.113.0/24, and specify a next hop (VM-B) for this traffic.
- D. Incorrect.
NAT gateways in Google Cloud are used for outbound internet access and IP address translation, not for routing traffic through specific VMs for inspection.