Answer-first summary for fast verification
Answer: 1. Set up two VPC networks: one trusted and the other untrusted. 2. Configure a virtual appliance using multiple network interfaces, with each interface connected to one of the VPC networks.
Option D is the correct answer because it aligns with Google Cloud's best practices for deploying a next-generation firewall (NGFW) as a virtual appliance to inspect traffic between trusted and untrusted segments. Using two separate VPC networks (one for trusted, one for untrusted) with a multi-NIC virtual appliance ensures that all traffic between the segments must pass through the firewall for inspection, as each NIC is connected to a different VPC network. This design provides clear segmentation and enforces traffic inspection without relying on complex routing rules that might bypass the firewall. The community discussion strongly supports D (92% consensus), with references to Google Cloud architecture documentation (e.g., 'Best practices for VPC design') and upvoted comments emphasizing multi-NIC appliances as the simplest and most effective method. Options A and B use a single VPC with subnets, which may not guarantee all traffic is inspected if routes are misconfigured or if intra-VPC traffic bypasses the appliance. Option C uses VPC peering, but peered networks allow direct communication between VPCs, potentially bypassing the firewall unless specific routes are enforced, making it less reliable than D's multi-NIC approach.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
You need to create two network segments: an untrusted subnet and a trusted subnet. You plan to deploy a virtual appliance, like a next-generation firewall (NGFW), to inspect all traffic between these segments. What is the correct network design to achieve this traffic inspection?
A
B
C
D
No comments yet.