Configuring Encrypted Private Connectivity Between Separate Organizations

PCSE By islever Editorial Last updated

Establishing private connectivity.

Short answer

B Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.

Question

Your organization hosts a financial services application running on Compute Engine instances for a third-party company. The third-party company's servers that
will consume the application also run on Compute Engine in a separate Google Cloud organization. You need to configure a secure network connection between
the Compute Engine instances. You have the following requirements:
✑ The network connection must be encrypted.
✑ The communication between servers must be over private IP addresses.
What should you do?
  1. Configure a Cloud VPN connection between your organizationג€™s VPC network and the third partyג€™s that is controlled by VPC firewall rules.
  2. Configure a VPC peering connection between your organizationג€™s VPC network and the third partyג€™s that is controlled by VPC firewall rules. Correct Answer
  3. Configure a VPC Service Controls perimeter around your Compute Engine instances, and provide access to the third party via an access level.
  4. Configure an Apigee proxy that exposes your Compute Engine-hosted application as an API, and is encrypted with TLS which allows access only to the third party.

Key Takeaways

The main trap is confusing VPC Peering with Cloud VPN; while VPN encrypts, it often relies on public internet transit, whereas VPC Peering provides direct, encrypted private IP connectivity on Google's backbone.

To connect Compute Engine instances across separate organizations with encryption and private IPs, configure VPC peering, which utilizes Google's encrypted backbone.

Common mistake: Choosing Cloud VPN (A) because it explicitly mentions encryption, ignoring that VPC Peering also provides encryption on Google's backbone while better satisfying the private IP constraint for inter-VPC traffic.

Expert Analysis

The scenario requires establishing a secure network connection between Compute Engine instances in separate Google Cloud organizations. The two mandatory constraints are that the connection must be encrypted and use private IP addresses.

Option A (Cloud VPN) creates an encrypted tunnel over the public internet. While it encrypts traffic, the underlying transport typically involves public IP routing between gateways, which conflicts with the strict requirement for communication solely over private IPs within a managed backbone context, although hybrid scenarios exist, VPC Peering is the native solution for inter-VPC private connectivity.

Option B (VPC Peering) connects two VPC networks directly. Google’s documentation confirms that all VM-to-VM traffic within peered VPC networks is automatically encrypted on Google’s internal backbone. This satisfies both requirements: encryption (via Google’s infrastructure) and private IP communication (via direct internal routing). Since the entities are in different organizations, global VPC peering is the correct mechanism.

Option C (VPC Service Controls) defines security perimeters to prevent data exfiltration but does not itself establish the network connectivity path between the two VPCs. It controls access to services, not the transport layer itself.

Option D (Apigee) exposes APIs over HTTP/HTTPS, which uses TLS encryption, but this requires exposing the service via an API gateway rather than establishing a direct network connection between the instances as requested. Additionally, it abstracts the network layer, moving away from the "network connection" requirement.

Official Reference

https://cloud.google.com/vpc/docs/vpc-peering

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked for a network connection between VPCs that must be private and encrypted, prioritize VPC Peering or Private Service Connect over Cloud VPN. Remember that Google encrypts all internal traffic (including peered VPCs) by default on its backbone, so you do not need to manually configure IPsec tunnels for encryption if using native GCP networking products.

Frequently Asked Questions

Does VPC Peering encrypt traffic?

Yes. All VM-to-VM traffic within a VPC network and peered VPC networks is encrypted on Google's internal backbone.

Can I use VPC Peering between different organizations?

Yes, Global VPC Peering allows connections between VPCs in different projects, networks, and even different Google Cloud organizations.

More PCSE FAQ →

Community Votes

B
60%
A
40%

60% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 24 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 24

  1. GHOST1985 👍 4 Answered B
    Google encrypts and authenticates data in transit at one or more network layers when data moves outside physical boundaries not controlled by Google or on behalf of Google. All VM-to-VM traffic within a VPC network and peered VPC networks is encrypted. https://cloud.google.com/docs/security/encryption-in-transit#cio-level_summary
  2. desertlotus1211 👍 4
    https://cloud.google.com/docs/security/encryption-in-transit#:~:text=All%20VM%2Dto%2DVM%20traffic,End%20(GFE)%20using%20TLS. All VM-to-VM traffic within a VPC network and peered VPC networks is encrypted. So for this fact and what I written below - Answer B.
  3. BPzen 👍 3 Answered A
    Encrypted Network Connection: A Cloud VPN connection encrypts traffic between the two VPC networks using IPsec. This satisfies the requirement for encryption. Private IP Communication: Cloud VPN enables communication between the two VPC networks over private IP addresses by establishing a secure tunnel. Control via Firewall Rules: Both organizations can manage traffic using VPC firewall rules, providing granular control over allowed communication. Why Not the Other Options? B. Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules: VPC peering does not encrypt traffic between networks. It does not satisfy the requirement for encryption.
  4. soltium 👍 3
    A and B is correct, Cloud VPN are encrypted, VPC Peering might be unencrypted but this docs said it's encrypted. https://cloud.google.com/docs/security/encryption-in-transit#virtual_machine_to_virtual_machine
  5. Littleivy 👍 3 Answered B
    B VPC Network Peering gives you several advantages over using external IP addresses or VPNs to connect networks https://cloud.google.com/vpc/docs/vpc-peering
Show 19 more comments
  1. Kouuupobol 👍 3 Answered A
    Answer is A, because it is explicitly said that trafic must be encrypted. Moreover, communication within the VPN use private IPs.
  2. TonytheTiger 👍 3
    B: https://cloud.google.com/vpc/docs/vpc-peering
  3. deony 👍 2
    i don't think that Cloud VPN use public IP, but encrypted. ref: https://cloud.google.com/network-connectivity/docs/vpn/concepts/overview > Traffic traveling between the two networks is encrypted by one VPN gateway and then decrypted by the other VPN gateway. This action protects your data as it travels over the internet. but, with cloud interconnect, Cloud VPN can use private IP. i think it's too heavy works using VPN with cloud interconnect instead of using VPC peering.
  4. AzureDP900 👍 2
    B. Configure a VPC peering connection between your organization's VPC network and the third party's that is controlled by VPC firewall rules.
  5. ppandher 👍 2
    It is encrypted by default at Network layer.
  6. alleinallein 👍 2
    Why not A? Any arguments?
  7. lolanczos 👍 1 Answered B
    B is correct because VPC peering establishes a private connection between VPC networks, allowing the Compute Engine instances to communicate using private IP addresses over Google’s encrypted backbone network. Option A (Cloud VPN) uses an encrypted tunnel but relies on public IP addresses; Option C (VPC Service Controls) is meant for securing service perimeters rather than direct network connectivity; and Option D (Apigee) is designed for API management, not for facilitating private network connections. Google Cloud. (n.d.). VPC Network Peering. Retrieved from https://cloud.google.com/vpc/docs/vpc-peering
  8. desertlotus1211 👍 1
    So I think this question makes on sense... If it's server to server calls then TLS/HTTPS/SSL is being used. So the answer can be VPC Peering since the APIs are encrypted. It's poorly worded and you will use service accont any communications and calls. You can usd VPN, but you need a cloud router on both side, policy routing, etc. for the CEs to talk. Thoughts?
  9. juanmacoellocloudsecarch 👍 1 Answered B
    VPN works over Public IP so that's make no sense for this question. And It says "net connection must be encrypted" but is not asking you how and if you need to configure or not. If you use VPC peering is only via private IP address and VPC peering is backbone encrypted so, B.
  10. TonytheTiger 👍 1
    Sorry - Ans C - Key point "separate Google Cloud Organization" Private Service Connect allows private consumption of services across VPC networks that belong to different groups, teams, projects, or organizations. https://cloud.google.com/vpc/docs/private-service-connect
  11. fad3r 👍 1
    You are right and wrong, You are right that yes Private Service Connect does indeed do this. You are wrong because that is not what C says. It says VPC Service Controls which is definitely wrong.
  12. desertlotus1211 👍 1
    Also ask for private IP communication, so technically no routing (policy or other) should be involved
  13. aygitci 👍 1 Answered A
    the traffic between the VPCs is not encrypted by default.
  14. desertlotus1211 👍 1
    All it asked for encryption...
  15. deony 👍 1
    typo: i don't think -> i think
  16. desertlotus1211 👍 1
    I meant to say NO sense....
  17. desertlotus1211 👍 1
    A is still on encrypted.
  18. irmingard_examtopics 👍 1 Answered A
    B is not encrypted.
  19. TNT87 👍 1 Answered B
    Answer B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

Integrating On-Premises Active Directory with Google Cloud IAM

S-grade

Cloud External Key Manager and Confidential VM Implementation Constraints

S-grade

← Back to PCSE Study Guide