Secure Network Architecture with Central Entry Point
You are creating a secure network architecture. You must fully isolate development and production environments, and prevent any network traffic between the two environments. The network team requires that there is only one central entry point to the cloud network from the on-premises environment. What should you do?
Community Votes
80% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests the distinction between network-level isolation (firewalls/peering) and service perimeter controls, specifically requiring a central transit hub for on-premises access.
Designing a secure cloud architecture requires isolating environments while maintaining a single on-premises entry point. Community consensus favors VPC peering for connectivity control, though VPC Service Controls offer data-centric isolation.
Many choose C because VPC Service Controls provide strong security, but they do not inherently solve the network routing requirement of a single central entry point from on-premises to multiple isolated VPCs without additional complexity.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D correctly addresses both isolation and connectivity requirements by creating separate VPCs for each environment and using a dedicated entry-point VPC. This 'hub-and-spoke' model allows all on-premises traffic to route through one central gateway, which then peers with the production and development VPCs. Firewall rules can be applied at the VPC level to strictly prevent direct traffic between dev and prod.Why the Other Options Are Wrong
Option A fails because adding the on-premises entry point only to production violates the requirement for a central entry point managing access to both. Option B is incorrect because sharing a VPC network undermines the goal of full isolation, as subnets within the same VPC are generally trusted unless strict firewalling is enforced, which is less robust than separate VPCs. Option C uses VPC Service Controls, which protect data exfiltration but do not inherently manage the network routing topology required for a single on-premises entry point across multiple VPCs.Community Comment Notes
Comments show a split between C and D. While some users argue for C due to its strong security posture, the majority (80%) agree with D. The key differentiator is the specific constraint: 'only one central entry point to the cloud network from the on-premises environment.' D provides a clear architectural pattern (Transit VPC) to satisfy this, whereas C focuses on data boundaries rather than network ingress topology.Official Reference
Exam Strategy
When questions specify 'one central entry point,' look for a Transit VPC or Hub-and-Spoke design. Do not confuse network isolation (VPCs/firewalls) with data isolation (Service Controls) unless explicitly asked about data exfiltration prevention.
Frequently Asked Questions
Why is VPC Service Controls (C) not the best answer?
VPC Service Controls focus on preventing data exfiltration, not on managing network routing topology. The question requires a specific network architecture for a single on-premises entry point.
Can I use Shared VPC (B) for isolation?
Shared VPCs share the same IP space and underlying network infrastructure. For 'full isolation' and preventing any network traffic, separate VPCs with firewalls are more robust and compliant with strict security policies.