Exam Professional Cloud Security Engineer topic 1 question 118 discussion

Answer = D Multiple network interfaces. The simplest way to connect multiple VPC networks through a virtual appliance is by using multiple network interfaces, with each interface connecting to one of the VPC networks. Internet and on-premises connectivity is provided over one or two separate network interfaces. With many NGFW products, internet connectivity is connected through an interface marked as untrusted in the NGFW software.

https://cloud.google.com/architecture/best-practices-vpc-design This architecture has multiple VPC networks that are bridged by an L7 next-generation firewall (NGFW) appliance, which functions as a multi-NIC bridge between VPC networks.

A, we need to define routing to divert all traffic through the network appliance https://cloud.google.com/architecture/architecture-centralized-network-appliances-on-google-cloud

I'm not sure id Answer D is the 'most' correct answer.... The subnet already exists... it didn't ask for a redesign.

D, specifically addresses the design of using two VPC networks and connecting a virtual appliance (NGFW) with multiple interfaces, each connected to a different VPC network. This design allows the appliance to inspect and control the traffic between the trusted and untrusted segments effectively.

D is the answer. https://cloud.google.com/architecture/best-practices-vpc-design#l7 This architecture has multiple VPC networks that are bridged by an L7 next-generation firewall (NGFW) appliance, which functions as a multi-NIC bridge between VPC networks. An untrusted, outside VPC network is introduced to terminate hybrid interconnects and internet-based connections that terminate on the outside leg of the L7 NGFW for inspection. There are many variations on this design, but the key principle is to filter traffic through the firewall before the traffic reaches trusted VPC networks.

B , 100% !