Professional Cloud Architect · Free Practice Question Hard
Question 21
A media streaming company is migrating its services to Google Cloud. The company's platform requires high bandwidth and low latency to ensure smooth video streaming for millions of users. The infrastructure needs to scale automatically based on demand, and security is a top priority to protect user data. The company plans to deploy its services across multiple regions, utilizing a mix of virtual machines, containers, and serverless functions. You are tasked with designing the network architecture to meet these requirements. Which of the following approaches would best address the company's needs for a secure, scalable, and high-performance network?
-
A
Utilize Shared VPC to centralize network management, with each service running in its own project. Configure Private Google Access for all resources and implement Identity-Aware Proxy (IAP) to secure access to the services.
-
B
Deploy multiple VPCs, one for each region, and connect them using VPC Peering. Use Google Cloud Load Balancing to distribute traffic across regions and set up firewall rules to deny all inbound traffic except from specific IP ranges.
-
C
Create a single VPC spanning multiple regions with custom subnets for each region. Implement Cloud NAT for outbound internet traffic and set up firewall rules to allow only necessary traffic.
-
D
Create a single VPC with default subnets in each region, and rely on Google Cloud’s default network security settings for firewall rules and routing to minimize configuration overhead.
Reveal correct answer
Correct answer: C
A.
While Shared VPC is a powerful feature for centralizing network management across multiple projects, it is more suitable for organizations with complex multi-project environments. The scenario does not explicitly require this level of project segmentation. Additionally, Identity-Aware Proxy (IAP) is a strong security feature, but it mainly secures user access to applications rather than addressing network performance and scalability across regions.
B.
While deploying multiple VPCs with VPC Peering might seem like a good way to isolate environments by region, it introduces additional complexity in managing network configurations and security policies. VPC Peering also does not support transitive peering, which could complicate routing between VPCs and impact latency. Additionally, relying solely on IP-based firewall rules can be challenging to manage and less secure than more granular controls.
C.
Creating a single VPC that spans multiple regions with custom subnets allows for centralized control while maintaining isolation between different environments. Using Cloud NAT for outbound traffic helps protect instances that do not require direct internet exposure, enhancing security. Custom firewall rules enable precise control over allowed traffic, ensuring security without sacrificing performance. This design balances scalability, performance, and security.
D.
Using a single VPC with default subnets and relying on Google Cloud’s default network security settings is not a recommended best practice for a high-performance, secure, and scalable network architecture. Default settings may not provide the necessary level of security, control, or optimization required by the company, leading to potential vulnerabilities and performance bottlenecks.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
