Associate Cloud EngineerDemo

By Google · Question Mode

QuestionQ27

Planning and configuring a cloud solution

Your company is migrating its entire workload to Compute Engine. Some servers need to be reachable from the Internet, while others should be reachable only over the internal network. All servers must be able to communicate with each other over specific ports and protocols.

The current on-premises network design uses:

  • A demilitarized zone (DMZ) for the public-facing servers
  • A Local Area Network (LAN) for the private servers

You need to design the Google Cloud networking infrastructure to match these requirements. What should you do?

  • A
    1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.
  • B
    1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.
  • C
    1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.
  • D
    1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.
Explanation

A single VPC containing separate subnets for the DMZ-equivalent (public) servers and the LAN-equivalent (private) servers lets every instance communicate with every other instance by default through internal routing, satisfying the requirement that all servers can talk to each other over specific ports/protocols. Firewall rules can then be layered on top to restrict traffic: one rule permits only the required ports/protocols between the DMZ and LAN subnets, and a separate rule allows public ingress traffic (from 0.0.0.0/0) only to the DMZ subnet's instances, giving them Internet reachability while the LAN subnet's instances remain internal-only. Ingress (not egress) rules are what control whether external clients can reach a server from the Internet, which is what 'accessible through the Internet' requires. Using two separate VPCs (as in choices C and D) would require additional connectivity mechanisms such as VPC Peering or Cloud VPN/Interconnect to let the DMZ and LAN servers communicate, adding unnecessary complexity compared to using subnets and firewall rules within a single VPC.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!