Professional Cloud Network EngineerDemo

By Google · Question Mode

QuestionQ102

Designing and planning a Google Cloud Virtual Private Cloud (VPC) network

Your company has acquired a new division. The new division's network team needs complete control of its networking infrastructure. You must extend your existing Google Cloud network infrastructure, which consists of a single VPC, so workloads from all divisions can communicate with one another. You want to avoid additional costs and avoid granting unnecessary permissions to the new division's networking team. What should you do?

  • A • Create a new project for the new division's network team.• Create a new VPC within the new project.• Establish a VPC peering between your existing VPC and the new division’s VPC.• Create a new subnet dedicated to the new division's workloads.• Grant roles/compute.networkUser on the new project to the new division’s network team group.
  • B • Create a new project for the new division's network team.• Create a new VPC within the new project.• Establish a VPC peering between your existing VPC and the new division’s VPC.• Grant roles/compute.networkAdmin on the newly created project to the new division's network team group.
  • C • Ensure that the project hosting the existing network infrastructure is enabled as a host project.• Create a new subnet dedicated to the new division's workloads in the existing VPC.• Grant roles/compute.networkUser on the newly created subnet to the new division’s network team group.
  • D • Create a new project for the new division's network team.• Create a new VPC within the new project.• Establish a VPN connection between your existing VPC and the new division's VPC.• Grant roles/compute.networkAdmin on the newly created project to the new division's network team group.
Explanation

"Complete control of its networking infrastructure" requires the new division to own and administer its own VPC, so you create a separate project and VPC and grant roles/compute.networkAdmin on that project only, which is least privilege and gives no rights over your existing infrastructure. VPC peering connects the two VPCs privately at no additional cost, avoiding the VPN gateway/egress charges of option D. Shared VPC (C) grants only roles/compute.networkUser on a subnet, letting the team use but not fully control the network, so it fails the "complete control" requirement; option A likewise grants only networkUser and is insufficient.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!