In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subnet. What should you do?

The correct answer is B. Create a more specific route than the system-generated subnet route, pointing the next hop to. Custom static routes can apply to all instances or specific instances. Static routes with a tag attribute apply to instances that have that same network tag. If the route doesn't have a network tag, the route applies to all instances in the network…

Submitted by chen.hong· Apr 18, 2026Implementing network security

Question

In order to provide subnet level isolation, you want to force instance-A in one subnet to route through a security appliance, called instance-B, in another subnet. What should you do?

Options

ACreate a more specific route than the system-generated subnet route, pointing the next hop to
BCreate a more specific route than the system-generated subnet route, pointing the next hop to
CDelete the system-generated subnet route and create a specific route to instance-B with a tag
DMove instance-B to another VPC and, using multi-NIC, connect instance-B's interface to instance-

How the community answered

(49 responses)

A
2% (1)
B
84% (41)
C
10% (5)
D
4% (2)

Explanation

Custom static routes can apply to all instances or specific instances. Static routes with a tag attribute apply to instances that have that same network tag. If the route doesn't have a network tag, the route applies to all instances in the network. https://cloud.google.com/vpc/docs/routes#subnet-routes

Topics

#VPC Routing#Custom Static Routes#Network Appliances#Next-hop IP

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice