Google Professional Cloud Network Engineer Question 686
Select 3Google Cloud PlatformYou are managing a multi-region Google Cloud deployment with a hybrid networking setup. Your organization requires that specific on-premises subnets are reachable from only one particular VPC, and you also need to tailor the routes advertised to your on-premises environment. How can you achieve this using Google Cloud's networking features?
- A
Create a custom route advertisement in the Cloud Router that advertises only the required VPC subnet ranges to the on-premises environment.
- B
Configure a custom learned route to restrict the on-premises subnet visibility to a specific VPC using route filters in the Cloud Router.
- C
Use VPC firewall rules to block access to the on-premises subnets from other VPCs.
- D
Set up a separate Cloud Router for each VPC and use custom route advertisements to control the routes shared with the on-premises environment.
- E
Enable dynamic routing on the interconnect and rely on Google Cloud to automatically learn and advertise only the required routes.
Show answer and explanation
Correct answers: A, B, D
Explanation
To achieve the scenario's requirements, you must use Cloud Router's custom route advertisement and filtering features to control which VPC subnets are advertised to the on-premises environment and which on-premises routes are learned by a specific VPC. Separating Cloud Routers for VPCs can further isolate route sharing. Firewall rules and relying solely on dynamic routing do not address the need for tailored route control.
- A. Correct.
Correct. Creating a custom route advertisement in the Cloud Router allows you to selectively advertise specific VPC subnet ranges to the on-premises environment, meeting the requirement for tailored route advertisements.
- B. Correct.
Correct. Configuring a custom learned route with route filters can help restrict which on-premises subnet routes are shared with a specific VPC, ensuring limited visibility.
- C. Incorrect.
Incorrect. VPC firewall rules manage traffic at the packet level, not routing. They cannot control route advertisement or subnet visibility.
- D. Correct.
Correct. Setting up separate Cloud Routers for VPCs and using custom route advertisements can help isolate route sharing between specific VPCs and the on-premises environment.
- E. Incorrect.
Incorrect. While enabling dynamic routing on the interconnect allows automatic route sharing, it does not give you granular control to advertise or filter specific routes as required.