Google Professional Cloud Network Engineer Question 614
Single answerGoogle Cloud PlatformYour organization has deployed multiple VPCs in Google Cloud for different departments. To secure and inspect inter-VPC traffic, you decided to deploy a next-generation firewall (NGFW) appliance using a multi-NIC VM. After configuring the multi-NIC VM, you notice that traffic between the VPCs is not being inspected as expected. What step is required to ensure that traffic is routed through the NGFW appliance for inspection?
- A
Configure VPC peering between all VPCs involved in the traffic flow.
- B
Create custom static routes in each VPC to direct traffic to the NGFW appliance.
- C
Enable firewall rules to allow all traffic between the VPCs.
- D
Assign the multi-NIC VM to a shared VPC to centralize traffic.
Show answer and explanation
Correct answer: B
Explanation
To ensure traffic between VPCs is inspected by the NGFW appliance, custom static routes must be configured in each VPC. These routes direct traffic to the appropriate interface on the multi-NIC VM. Without these routes, traffic may bypass the NGFW appliance entirely, defeating the purpose of inspection. Other options like VPC peering or enabling firewall rules help with connectivity and access control but do not enforce traffic flow through the NGFW appliance.
- A. Incorrect.
Configuring VPC peering establishes connectivity between VPCs but does not ensure traffic is routed through the NGFW appliance. Traffic would bypass the appliance unless routes are explicitly defined.
- B. Correct.
Custom static routes are required to explicitly direct traffic to the specific interface of the multi-NIC NGFW appliance for inspection. This ensures traffic flows through the appliance before reaching the destination.
- C. Incorrect.
Enabling firewall rules allows traffic to flow but does not ensure traffic inspection. Firewall rules alone cannot force traffic through the NGFW appliance.
- D. Incorrect.
Assigning the multi-NIC VM to a shared VPC centralizes management but does not enforce traffic routing through the NGFW appliance unless routes are explicitly configured.