Vpc Peering Non Transitive Routing Firewall

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization operates a multi-VPC architecture across multiple Google Cloud projects. You have a central hub network named hub-vpc (10.0.0.0/16) that is connected via VPC Network Peering to spoke-a-vpc (10.1.0.0/16). You deploy a new custom VPC named spoke-b-vpc (10.2.0.0/16) and configure VPC Network Peering between spoke-b-vpc and hub-vpc.

Workloads running in spoke-b-vpc must directly access backend services running in spoke-a-vpc over private RFC 1918 IP addresses. Currently, network traffic from spoke-b-vpc fails to reach spoke-a-vpc. Furthermore, the ingress firewall rules in spoke-a-vpc only allow traffic originating from 10.1.0.0/16.

How should you resolve the connectivity issue while adhering to Google Cloud networking best practices?

Create a bidirectional VPC Network Peering connection directly between spoke-a-vpc and spoke-b-vpc, and update the ingress firewall rules in both VPCs to allow traffic from the respective RFC 1918 peer subnet ranges.

Configure custom static routes in hub-vpc targeting spoke-a-vpc and spoke-b-vpc, and enable custom route exporting across all existing peering connections.

Deploy Cloud NAT in hub-vpc and configure proxy routing to translate traffic between spoke-a-vpc and spoke-b-vpc.

Modify the existing peering on hub-vpc to enable export of subnet routes with public IPs, and rely on the implied default VPC firewall rules for inter-subnet communication.

Professional Cloud DevOps Engineer

Vpc Peering Non Transitive Routing Firewall

Related questions