Google Professional Cloud Security Engineer Question 273
Select 2Google Cloud PlatformYou are tasked with designing a secure and highly available connection between your on-premises data center and a Google Cloud Virtual Private Cloud (VPC) network. The connection must use encryption and support failover in case of a single connection failure. Which combination of solutions should you implement?
- A
Configure HA VPN with two tunnels per gateway and ensure the use of IKEv2 for encryption.
- B
Use Cloud Interconnect with Dedicated Interconnect circuits and enable MACsec encryption.
- C
Deploy two HA VPN gateways in separate regions to ensure global failover.
- D
Set up Partner Interconnect with multiple connections and use IPsec for encryption.
- E
Use a single HA VPN gateway with one tunnel for simplicity and reduced cost.
Show answer and explanation
Correct answers: A, D
Explanation
To meet the requirements of secure and highly available connectivity between the on-premises data center and the Google Cloud VPC, HA VPN with dual tunnels provides redundancy and uses IKEv2 for encryption. Partner Interconnect, when combined with IPsec, also satisfies the encryption and failover requirements. A single HA VPN gateway or solutions without proper encryption like Dedicated Interconnect alone do not meet both criteria.
- A. Correct.
This is correct because HA VPN is designed for high availability by default and uses two tunnels per gateway. IKEv2 ensures strong encryption for secure communication.
- B. Incorrect.
This is incorrect because while Cloud Interconnect provides high bandwidth and can use MACsec encryption, it does not natively provide IPsec encryption for end-to-end data security, which is a requirement in this scenario.
- C. Incorrect.
This is incorrect because deploying HA VPN gateways in separate regions is not a supported feature for global failover. HA VPN is region-specific and requires configuration within a single region.
- D. Correct.
This is correct because Partner Interconnect allows for multiple connections and can be combined with IPsec to provide encryption, meeting both the encryption and failover requirements.
- E. Incorrect.
This is incorrect because using a single HA VPN gateway with one tunnel does not meet the high availability requirement. High availability requires at least two tunnels for redundancy.