Your company's current network architecture has two VPCs that are connected by a dual-NIC instance that acts as a bump-in-the-wire firewall between the two VPCs. Flows between pairs of subnets…

Question

Options

• AVerify that a VPC Service Controls perimeter has not been enabled for the project that contains
• BUse Cloud Logging to verify that there were no modifications to the VPC firewall rules or policies
• CVerify that a public IP address has not been assigned to any network interface of the dual-NIC
• DVerify that the dual-NIC instance has the --can-Ip-Forward attribute enabled.
• EVerify that the dual-NIC instance has not been added to a backend service.

• A
  12% (3)
• B
  76% (19)
• C
  4% (1)
• E
  8% (2)

Explanation

A dual-NIC instance acting as a bump-in-the-wire firewall requires two things to function correctly: (1) IP forwarding must be enabled on the instance (--can-ip-forward flag), and (2) the VPC firewall rules or policies must allow the forwarded traffic. Option D is correct because if IP forwarding is disabled on the instance (e.g., due to a reconfiguration), the instance will drop all packets it is supposed to route between VPCs - this would explain a sudden total failure. Option B is correct because changes to VPC firewall rules or policies could block traffic before it even reaches the dual-NIC instance. Option A (VPC Service Controls) would affect API-level access, not VM-to-VM network flows. Option C (public IP assignment) would not block inter-VPC traffic. Option E (adding to a backend service) is irrelevant to routing behavior.

No community discussion yet for this question.