An enterprise is planning a large-scale migration of on-premises workloads and databases across multiple departments to Google Cloud. The migration strategy requires a secure, scalable network architecture that satisfies the following criteria: Centralized Administration: Network resources, routing policies, and security perimeters must be managed centrally by a core networking team, while individual application teams manage their own workloads in separate projects. Hybrid Connectivity Reuse: On-premises systems must connect over a high-bandwidth, redundant Cloud Interconnect connection without requiring each departmental project to provision its own dedicated physical links. Multi-Region Reachability: Workloads deployed across multiple Google Cloud regions must communicate dynamically with the on-premises environment, prioritizing local paths while maintaining reachability to all VPC subnets. Which network architecture should you design to meet these requirements?

Deploy a Shared VPC host project with dynamic routing set to global on the Cloud Router, attach departmental service projects, and provision Cloud Interconnect VLAN attachments in the Shared VPC host project.: ### What Shared VPC with Global Dynamic Routing Is **Shared VPC** allows an organization to connect resources from multiple service projects to a common, centrally managed Virtual Private Cloud (**VPC**) network. When combined with **Cloud Interconnect** and a **Cloud Router** configured for **global dynamic routing**, the Cloud Router uses External Border Gateway Protocol (**eBGP**) to advertise all subnets across all regions within the VPC to the on-premises network while dynamically learning on-premises routes. ### How It Meets the Requirements - **Centralized Administration:** The host project centralizes the creation and governance of subnets, firewall rules, and routes under the network administrator team. Departmental teams are delegated permissions as **Service Project Admins** to deploy compute resources into specific shared subnets without managing network infrastructure. - **Hybrid Connectivity Reuse:** Provisioning **Cloud Interconnect** with VLAN attachments in the **Shared VPC host project** enables all VM instances across all attached service projects to utilize the high-speed hybrid connection without replicating interconnect attachments in individual projects. - **Multi-Region Reachability:** Configuring the **Cloud Router** with **global dynamic routing** advertises subnets from all Google Cloud regions to the on-premises network. It automatically computes a metric penalty (MED) for routes outside the local region to maintain traffic symmetry and prefer local interconnect paths. ### Key Advantages and Capabilities - **Operational Efficiency:** Eliminates duplicate interconnect circuits, VPN gateways, and complex point-to-point routing topologies. - **Dynamic Route Propagation:** BGP dynamically exchanges route prefixes without requiring manual static route updates when new subnets are added. - **Granular Access Control:** Network User IAM roles can be granted at the individual subnet level to preserve team boundaries. - **Predictable Performance:** Dedicated bandwidth via **Cloud Interconnect** provides consistent latency and high throughput for heavy data transfers. ### Why This Is Optimal This architecture is the recommended best practice for enterprise hybrid deployments in Google Cloud. It provides strict security and operational isolation between the network administration team and application teams while establishing a unified, high-performance routing fabric across multiple regions.

StudyCerts

Design Hybrid Shared Vpc Interconnect Routing | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Design Hybrid Shared Vpc Interconnect Routing

Section: Using migration methodologies, workload testing, network planning, and dependency planning

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is planning a large-scale migration of on-premises workloads and databases across multiple departments to Google Cloud. The migration strategy requires a secure, scalable network architecture that satisfies the following criteria:

Centralized Administration: Network resources, routing policies, and security perimeters must be managed centrally by a core networking team, while individual application teams manage their own workloads in separate projects.
Hybrid Connectivity Reuse: On-premises systems must connect over a high-bandwidth, redundant Cloud Interconnect connection without requiring each departmental project to provision its own dedicated physical links.
Multi-Region Reachability: Workloads deployed across multiple Google Cloud regions must communicate dynamically with the on-premises environment, prioritizing local paths while maintaining reachability to all VPC subnets.

Which network architecture should you design to meet these requirements?

Deploy independent VPC networks in each departmental project, connect each VPC directly to on-premises using separate Cloud VPN tunnels with static routing, and assign instance tags to control traffic flow.

Deploy a single Shared VPC host project with dynamic routing set to regional on the Cloud Router, and create VPC Network Peering connections between all departmental projects and the host project.

Deploy a Shared VPC host project with dynamic routing set to global on the Cloud Router, attach departmental service projects, and provision Cloud Interconnect VLAN attachments in the Shared VPC host project.

Deploy auto-mode VPC networks in each departmental project, deploy a multi-NIC VM instance inside each project acting as an edge router, and connect each VM to on-premises using Private Service Connect.

Professional Cloud Architect

Design Hybrid Shared Vpc Interconnect Routing

Related questions