PCNE Question 32

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  The correct option is A. Because Shared VPC Host Project is the best approach for centralized network management and security policies. Here, the security appliance requires two network interfaces (NICs) for inspecting and filtering traffic between different VPCs or subnets. In this setup, you can create a 2-NIC instance in us-west1 (your primary region) in the Host Project. Each NIC is attached to a different VPC subnet within the Host Project, allowing traffic to be inspected as it flows between different subnets or VPCs. Now you will configure routes and firewall rules to ensure traffic flows through the appliance for L7 inspection before proceeding to the destination.

• 1

  I agree with ESP_SAP and BenMS. You need multiple VPCs due to the mulitple NIC requirement. Since this is a network/security-specific appliance, intended to be inline between networks for traffic inspection, it should be maintained under network control, not individual service project control. So it should be in the host project. Google has a good illustration of this in their Best Practices and Reference Architecture for VPC Design guide, here (slightly down on this page, where it talks about third-party VM instances for advanced security use cases): https://docs.cloud.google.com/architecture/best-practices-vpc-design#manage_traffic_with_gcp_firewall_rules You can see that they have multiple VPCs in the host project, with the FW VM instances installed in the host project, connecting between those VPCs.

• 1

  https://medium.com/google-cloud/google-cloud-shared-vpc-b33e0c9dd320 ....based on this answer is B , the VM to be configured in service project. The host project is used for routes and FW rules.