Exam Professional Cloud Security Engineer topic 1 question 143 discussion

B is correct because VPC peering establishes a private connection between VPC networks, allowing the Compute Engine instances to communicate using private IP addresses over Google’s encrypted backbone network. Option A (Cloud VPN) uses an encrypted tunnel but relies on public IP addresses; Option C (VPC Service Controls) is meant for securing service perimeters rather than direct network connectivity; and Option D (Apigee) is designed for API management, not for facilitating private network connections. Google Cloud. (n.d.). VPC Network Peering. Retrieved from https://cloud.google.com/vpc/docs/vpc-peering

Encrypted Network Connection: A Cloud VPN connection encrypts traffic between the two VPC networks using IPsec. This satisfies the requirement for encryption. Private IP Communication: Cloud VPN enables communication between the two VPC networks over private IP addresses by establishing a secure tunnel. Control via Firewall Rules: Both organizations can manage traffic using VPC firewall rules, providing granular control over allowed communication. Why Not the Other Options? B. Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules: VPC peering does not encrypt traffic between networks. It does not satisfy the requirement for encryption.

the traffic between the VPCs is not encrypted by default.

https://cloud.google.com/docs/security/encryption-in-transit#:~:text=All%20VM%2Dto%2DVM%20traffic,End%20(GFE)%20using%20TLS. All VM-to-VM traffic within a VPC network and peered VPC networks is encrypted. So for this fact and what I written below - Answer B.

So I think this question makes on sense... If it's server to server calls then TLS/HTTPS/SSL is being used. So the answer can be VPC Peering since the APIs are encrypted. It's poorly worded and you will use service accont any communications and calls. You can usd VPN, but you need a cloud router on both side, policy routing, etc. for the CEs to talk. Thoughts?

Answer is A, because it is explicitly said that trafic must be encrypted. Moreover, communication within the VPN use private IPs.

Answer B

Why not A? Any arguments?

B: https://cloud.google.com/vpc/docs/vpc-peering

B VPC Network Peering gives you several advantages over using external IP addresses or VPNs to connect networks https://cloud.google.com/vpc/docs/vpc-peering

B. Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.

A and B is correct, Cloud VPN are encrypted, VPC Peering might be unencrypted but this docs said it's encrypted. https://cloud.google.com/docs/security/encryption-in-transit#virtual_machine_to_virtual_machine

B. Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.

B is the answer.

final B

Google encrypts and authenticates data in transit at one or more network layers when data moves outside physical boundaries not controlled by Google or on behalf of Google. All VM-to-VM traffic within a VPC network and peered VPC networks is encrypted. https://cloud.google.com/docs/security/encryption-in-transit#cio-level_summary

sry A