Secure Network Architecture with Central Entry Point

PCSE By islever Editorial Last updated Sep 7, 2026

Short answer

D Create one Virtual Private Cloud (VPC) network per environment. Create one additional VPC for the entry point to the cloud network. Peer the entry point VPC with the environment VPCs.

Question

You are creating a secure network architecture. You must fully isolate development and production environments, and prevent any network traffic between the two environments. The network team requires that there is only one central entry point to the cloud network from the on-premises environment. What should you do?

Create one Virtual Private Cloud (VPC) network per environment. Add the on-premises entry point to the production VPC. Peer the VPCs with each other and create firewall rules to prevent traffic.
Create one shared Virtual Private Cloud (VPC) network and use it as the entry point to the cloud network. Create separate subnets per environment. Create firewall rules to prevent traffic.
Create one Virtual Private Cloud (VPC) network per environment. Create a VPC Service Controls perimeter per environment and add one environment VPC to each.
Create one Virtual Private Cloud (VPC) network per environment. Create one additional VPC for the entry point to the cloud network. Peer the entry point VPC with the environment VPCs. Correct Answer

Key Takeaways

The question tests the distinction between network-level isolation (firewalls/peering) and service perimeter controls, specifically requiring a central transit hub for on-premises access.

Designing a secure cloud architecture requires isolating environments while maintaining a single on-premises entry point. Community consensus favors VPC peering for connectivity control, though VPC Service Controls offer data-centric isolation.

Common mistake: Many choose C because VPC Service Controls provide strong security, but they do not inherently solve the network routing requirement of a single central entry point from on-premises to multiple isolated VPCs without additional complexity.

Expert Analysis

Why the Answer Is Correct

Option D correctly addresses both isolation and connectivity requirements by creating separate VPCs for each environment and using a dedicated entry-point VPC. This 'hub-and-spoke' model allows all on-premises traffic to route through one central gateway, which then peers with the production and development VPCs. Firewall rules can be applied at the VPC level to strictly prevent direct traffic between dev and prod.

Why the Other Options Are Wrong

Option A fails because adding the on-premises entry point only to production violates the requirement for a central entry point managing access to both. Option B is incorrect because sharing a VPC network undermines the goal of full isolation, as subnets within the same VPC are generally trusted unless strict firewalling is enforced, which is less robust than separate VPCs. Option C uses VPC Service Controls, which protect data exfiltration but do not inherently manage the network routing topology required for a single on-premises entry point across multiple VPCs.

Community Comment Notes

Comments show a split between C and D. While some users argue for C due to its strong security posture, the majority (80%) agree with D. The key differentiator is the specific constraint: 'only one central entry point to the cloud network from the on-premises environment.' D provides a clear architectural pattern (Transit VPC) to satisfy this, whereas C focuses on data boundaries rather than network ingress topology.

Official Reference

Array

This link opens the official vendor documentation in a new tab.

Exam Strategy

When questions specify 'one central entry point,' look for a Transit VPC or Hub-and-Spoke design. Do not confuse network isolation (VPCs/firewalls) with data isolation (Service Controls) unless explicitly asked about data exfiltration prevention.

Frequently Asked Questions

Why is VPC Service Controls (C) not the best answer?

VPC Service Controls focus on preventing data exfiltration, not on managing network routing topology. The question requires a specific network architecture for a single on-premises entry point.

Can I use Shared VPC (B) for isolation?

Shared VPCs share the same IP space and underlying network infrastructure. For 'full isolation' and preventing any network traffic, separate VPCs with firewalls are more robust and compliant with strict security policies.

More PCSE FAQ →

Community Votes

80%

20%

80% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

SQLbox 👍 1

C , due to you must fully isolate development and production environments, and prevent any network traffic between the two environments
nah99 👍 2 Answered D

D satisfies all requirements
yokoyan 👍 1 Answered C

I think it's C.
d0fa7d5 👍 1 Answered D

d is correct?
koo_kai 👍 1 Answered D

It's D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to PCSE Study Guide