An enterprise maintains a hybrid architecture connecting an on-premises data center to a Google Cloud Virtual Private Cloud (VPC) over Cloud Interconnect. The organization has established the following security and networking requirements for name resolution: On-premises clients must resolve internal Google Cloud private DNS zones and Private Service Connect endpoints. Google Cloud Compute Engine instances must resolve corporate domains hosted on on-premises domain controllers without manually modifying client resolver configurations. The security operations center (SOC) must monitor and audit all name resolution requests to detect domain generation algorithm (DGA) query patterns and potential DNS data exfiltration attempts. Which Cloud DNS design and policy configuration should the security engineer implement to satisfy these requirements?

Create a Cloud DNS server policy attached to the VPC with inbound query forwarding enabled, configure outbound private forwarding zones to direct on-premises domain queries to the on-premises DNS servers, and enable Cloud DNS query logging on the VPC network.: What Cloud DNS Server Policies and Query Logging Are Cloud DNS Server Policies and DNS Query Logging provide centralized management and visibility over internal DNS resolution across Google Cloud VPC networks and connected hybrid environments. A server policy allows administrators to control inbound and outbound DNS traffic pathways for all Compute Engine workloads within a VPC network, while query logging captures end-to-end DNS activity for threat analysis. How It Meets the Requirements Inbound Hybrid Resolution: Enabling inbound DNS query forwarding within the server policy provisions a reserved Google Cloud internal IP address in the VPC subnet. On-premises DNS forwarders can route queries for internal Google Cloud domains and Private Service Connect endpoints to these designated inbound forwarder IP addresses. Outbound Hybrid Resolution: Creating a Cloud DNS private forwarding zone for the corporate on-premises domain (or configuring alternative name servers) transparently directs VM resolution requests across the hybrid link to on-premises DNS servers without modifying /etc/resolv.conf or guest operating system settings. DGA and Anomaly Detection: Enabling Cloud DNS query logging records all inbound, internal, and outbound DNS transactions directly to Cloud Logging. The SOC can stream these logs into SIEM/SOAR platforms to analyze high-frequency query bursts, anomalous character entropy, and repetitive NXDOMAIN responses indicative of Domain Generation Algorithms (DGA). Key Advantages Centralized VPC Governance: Server policies automatically apply to all current and future VM instances within the VPC network. Zero Agent Overhead: Native logging operates at the VPC network fabric level without requiring guest OS logging agents. Granular Threat Telemetry: Captures query names, record types, response codes, and source VM identifiers for forensics. High Availability: Inbound forwarders scale automatically across Google Cloud infrastructure without single points of failure. Why This Is Optimal This architecture uses native Google Cloud networking constructs to achieve fully bidirectional private name resolution while ensuring complete logging visibility across all hybrid resolution paths.