Google Professional Cloud Network Engineer Question 607
Select 2Google Cloud PlatformYour organization requires that all internal traffic flowing between two VPC networks in different regions is inspected for compliance with security policies. The inspection must occur in a centralized location. You are tasked with configuring this setup using Google Cloud. Which combination of configurations should you use to achieve this?
- A
Deploy a Google Cloud firewall rule allowing traffic between the two VPC networks.
- B
Set up a VPC Network Peering connection between the two VPC networks.
- C
Configure a central hub VPC with a third-party network appliance for inspection.
- D
Use a Cloud VPN or Cloud Interconnect to route traffic between the two VPC networks via the central hub.
- E
Leverage Google Cloud's Private Service Connect to enforce inspection at a central location.
Show answer and explanation
Correct answers: C, D
Explanation
To implement centralized packet inspection between two VPCs in different regions, you should configure a hub-and-spoke topology. A central hub VPC with a third-party network appliance is used for inspection, while a routing mechanism like Cloud VPN or Cloud Interconnect ensures traffic flows through the hub. This setup enables compliance with security policies by inspecting all traffic between the VPCs.
- A. Incorrect.
This option does not address packet inspection. While firewall rules can control which traffic is allowed or denied, they do not provide deep packet inspection or compliance checks.
- B. Incorrect.
VPC Network Peering allows private connectivity between VPCs but does not provide a mechanism for centralized packet inspection.
- C. Correct.
A central hub VPC with a third-party network appliance is a common pattern for centralized packet inspection and can enforce compliance policies effectively.
- D. Correct.
Routing traffic via a central hub using Cloud VPN or Cloud Interconnect ensures that all traffic between the two VPCs flows through the inspection point, allowing the network appliance to analyze packets.
- E. Incorrect.
Private Service Connect is used for private communication between services and is not a suitable option for centralized traffic inspection.