Google Professional Cloud Network Engineer Question 613
Select 2Google Cloud PlatformYour organization uses multiple VPCs to segment workloads, and you are tasked with setting up a centralized next-generation firewall appliance to inspect and control traffic between these VPCs. The firewall is deployed in its own VPC as a VM with multiple NICs. How can you ensure that inter-VPC traffic is routed through the firewall for inspection before reaching its destination?
- A
Create custom static routes in the source and destination VPCs to direct traffic to the firewall's NIC IPs as next hops.
- B
Enable VPC Network Peering between the source, destination, and firewall VPCs to allow traffic to flow through the firewall.
- C
Use a Shared VPC setup and attach all VPCs to the same host project to share the firewall.
- D
Configure the firewall VM's NICs with separate subnets and use route tables to handle traffic inspection.
- E
Disable the default route in all VPCs to force traffic to flow through the firewall.
Show answer and explanation
Correct answers: A, D
Explanation
To route and inspect inter-VPC traffic using a next-generation firewall appliance, you must explicitly configure custom static routes in the source and destination VPCs to direct traffic to the firewall's NIC IPs as next hops. Additionally, the firewall VM's multiple NICs should be configured with separate subnets, and route tables should be used to ensure proper traffic inspection and forwarding. Simply enabling VPC Network Peering or using Shared VPC does not achieve the required traffic flow through the firewall.
- A. Correct.
This is correct. Custom static routes are required to direct traffic from the source and destination VPCs to the firewall's NICs for inspection.
- B. Incorrect.
This is incorrect. While VPC Network Peering allows connectivity between VPCs, it does not inherently route traffic through the firewall for inspection.
- C. Incorrect.
This is incorrect. Shared VPC can consolidate network resources but does not provide a mechanism for routing traffic through a firewall.
- D. Correct.
This is correct. Configuring the firewall VM's NICs with separate subnets and using route tables ensures that traffic can be inspected and forwarded appropriately.
- E. Incorrect.
This is incorrect. Disabling the default route will disrupt all traffic routing and is not a valid solution for enforcing traffic inspection.