You are designing a shared VPC architecture. Your network and security team has strict controls over which routes are exposed between departments. Your Production and Staging departments can…

Question

Options

• ACreate 2 shared VPCs within the shared VPC Host Project, and enable VPC peering between
• BCreate 2 shared VPCs within the shared VPC Host Project, and create a Cloud VPN/Cloud
• CCreate 2 shared VPCs within the shared VPC Service Project, and create a Cloud VPN/Cloud
• DCreate 1 VPC within the shared VPC Host Project, and share individual subnets with the Service

• A
  5% (1)
• B
  5% (1)
• C
  10% (2)
• D
  81% (17)

Explanation

Google's recommended Shared VPC design places all VPC networks and subnets in a centralized Host Project and then selectively shares individual subnets with Service Projects representing different departments (Production, Staging, etc.). This gives the network/security team granular control: each department only sees and uses the subnets explicitly shared with it, so route exposure between departments is tightly governed. Options A and B are wrong because creating multiple Shared VPCs inside the Host Project is not a standard or recommended pattern - the host project itself holds the single authoritative VPC. Option C is incorrect because Shared VPC service projects cannot host shared VPCs; only the host project can. Creating VPNs between service-project VPCs (C) adds unnecessary complexity versus the cleaner subnet-sharing model in D.

No community discussion yet for this question.