Google Professional Cloud Network Engineer Question 775
Single answerGoogle Cloud PlatformYour company operates multiple Google Cloud projects for different business units. To ensure network resources like VPCs and subnets are isolated between projects, but still allow centralized control of shared resources like Cloud Interconnect and VPNs, what is the best approach to achieve this?
- A
Use project-level VPCs and configure VPC peering between the projects.
- B
Use Shared VPC to host centralized resources in a host project and allow service projects to connect to it.
- C
Use a single project to host all resources and organize them using labels for identification.
- D
Use global static routes to connect all VPCs across different projects.
Show answer and explanation
Correct answer: B
Explanation
Shared VPC is the best solution for managing network resources in a multi-project environment with centralized control. It allows a host project to manage shared resources like Cloud Interconnect or VPNs while enabling service projects to maintain isolation for their own VPCs and workloads. This approach ensures scalability, security, and simplified network management compared to alternatives like VPC peering or merging resources in a single project.
- A. Incorrect.
Using project-level VPCs with VPC peering can isolate resources, but it creates a complex and hard-to-manage network architecture, especially as the number of projects grows. Additionally, VPC peering does not support transitive routing, limiting the flexibility of centralized resource sharing.
- B. Correct.
Shared VPC is designed for this purpose. It allows centralized control of resources like Cloud Interconnect and VPNs in a host project while keeping other resources isolated in service projects. This setup is scalable and simplifies network management.
- C. Incorrect.
Hosting all resources in a single project does not provide the required isolation between business units. This approach may lead to security risks and administrative challenges as the organization grows.
- D. Incorrect.
Global static routes cannot be used to directly connect VPCs across projects. This solution is not practical for managing complex inter-project connectivity.