In your company, two departments with separate GCP projects (code-dev and data-dev) in the same organization need to allow full cross-communication between all of their virtual machines in GCP. Each d

Question

Options

• AConnect both projects using Cloud VPN.
• BConnect the VPCs in project code-dev and data-dev using VPC Network Peering.
• CEnable Shared VPC in one project (e. g., code-dev), and make the second project (e. g., data-
• DEnable firewall rules to allow all ingress traffic from all subnets of project code-dev to all instances
• ECreate a route in the code-dev project to the destination prefixes in project data-dev and use

• A
  13% (6)
• B
  57% (27)
• C
  6% (3)
• E
  23% (11)

Explanation

VPC Network Peering (B) is the correct connectivity method here because it enables private RFC 1918 traffic between two VPCs while each project retains full, autonomous control of its own network - directly satisfying the "full control" requirement. After peering is established, firewall rules (D) must explicitly allow ingress traffic, because GCP's default-deny ingress policy blocks all traffic until you create rules permitting it; peering alone creates the path but the firewall is the gate.

Why the distractors fail:

• A (Cloud VPN) incurs per-hour tunnel charges, making it more expensive than peering for same-organization GCP traffic that never needs to leave Google's network.
• C (Shared VPC) centralizes network control in a host project, violating the requirement that each department retains full control of its own network.
• E (Manual routes) is unnecessary because VPC Peering automatically exchanges and imports routes between peered networks - manual route creation is redundant and incomplete on its own.

Memory tip: Use the phrase "Peer + Permit" - Peering (B) builds the private bridge between VPCs, and firewall rules (D) Permit the traffic across it. If either is missing, communication fails.

No community discussion yet for this question.