A financial enterprise is migrating multi-terabyte datasets containing sensitive customer records from an on-premises data center to Google Cloud. The compliance and security team has mandated the following requirements for data transit: Provide a dedicated, high-bandwidth physical connection between the on-premises facility and Google Cloud Enforce IPsec encryption in transit across the private connection for all transmitted packets Protect against unauthorized data exfiltration to external Google Cloud services and storage buckets Achieve a 99.99% Service Level Agreement (SLA) for the hybrid connectivity architecture Which solution should the enterprise implement?

Deploy Dedicated Interconnect across two regions with encrypted VLAN attachments and HA VPN, and configure a VPC Service Controls perimeter around the target cloud resources.: ### What Dedicated Interconnect with HA VPN and VPC Service Controls is **Dedicated Interconnect with HA VPN (HA VPN over Cloud Interconnect)** combines the high-throughput, low-latency private physical transport of Google Cloud Dedicated Interconnect with network-layer **IPsec encryption**. **VPC Service Controls** establishes a secure isolation boundary (service perimeter) around Google Cloud managed services such as Cloud Storage and BigQuery to mitigate data exfiltration risks. ### How it meets the requirements - **Dedicated high-bandwidth connection**: Dedicated Interconnect provides direct physical 10 Gbps or 100 Gbps circuits between the on-premises network and Google's colocation facilities. - **End-to-end IPsec encryption**: Encrypted VLAN attachments paired with **HA VPN gateways and tunnels** ensure all data passing across the private Interconnect circuits is encapsulated with standards-based IPsec encryption. - **Data exfiltration prevention**: Placing Google Cloud resources within a **VPC Service Controls service perimeter** prevents data from being copied or moved to unauthorized buckets, services, or identities outside the perimeter. - **99.99% SLA**: Deploying four Dedicated Interconnect connections with HA VPN across two separate regions in redundant edge availability domains meets Google's architecture requirements for a 99.99% uptime guarantee. ### Key advantages and capabilities - **Private and Encrypted Transit**: Delivers line-rate encryption over private links without routing traffic across the public internet. - **Perimeter-level Data Security**: Context-aware access policies and perimeter boundaries prevent malicious or accidental egress of sensitive records. - **Multi-Region Redundancy**: Dual-region dual-zone topology guarantees enterprise-grade fault tolerance. - **Dynamic Route Management**: Leverages BGP via **Cloud Router** for automated failover and topology updates. ### Why this is optimal This approach directly satisfies all bandwidth, high-availability, encryption-in-transit, and perimeter-level data exfiltration requirements simultaneously, whereas standard interconnect or internet VPN solutions fail to meet one or more of these criteria.

StudyCerts

Secure High Throughput Hybrid Data Transit | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Secure High Throughput Hybrid Data Transit

Section: Movement of data

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is migrating multi-terabyte datasets containing sensitive customer records from an on-premises data center to Google Cloud. The compliance and security team has mandated the following requirements for data transit:

Provide a dedicated, high-bandwidth physical connection between the on-premises facility and Google Cloud
Enforce IPsec encryption in transit across the private connection for all transmitted packets
Protect against unauthorized data exfiltration to external Google Cloud services and storage buckets
Achieve a 99.99% Service Level Agreement (SLA) for the hybrid connectivity architecture

Which solution should the enterprise implement?

Deploy Dedicated Interconnect across two regions with encrypted VLAN attachments and HA VPN, and configure a VPC Service Controls perimeter around the target cloud resources.

Establish VPC Network Peering directly between the on-premises router and the VPC, and assign strict Identity and Access Management (IAM) storage roles.

Provision Partner Interconnect Layer 2 connections with standard unencrypted VLAN attachments, and deploy Cloud Armor security policies on the target VPC.

Deploy standard HA VPN gateways over the public internet across two regions, and configure VPC firewall rules to block egress to non-approved IP addresses.

Professional Cloud Architect

Secure High Throughput Hybrid Data Transit

Related questions