GCP Professional Cloud Architect Practice Question

A retailer runs a REST-based order-management application on-premises. A logistics partner must call this API from the public internet, but the security team requires that the backend remain reachable only over a private network. The company also needs per-partner request quotas, OAuth 2.0 enforcement, and detailed usage analytics-all without modifying the legacy application. You already operate workloads on Google Cloud and want to minimize ongoing operational effort. Which approach best meets these requirements?

Re-engineer the API as Cloud Functions behind Cloud Endpoints and retire the on-prem system.
Establish VPC Network Peering between the on-prem network and Google Cloud and share the private service address directly with the partner.
Deploy Apigee X in Google Cloud, connect its runtime to the on-prem API over Cloud VPN, and expose the Apigee-managed HTTPS endpoint to the partner.
Expose the on-prem API through an external TCP load balancer with Cloud NAT; enforce quotas and OAuth in application code.

Report Issue

Answer Description

Using Apigee X addresses every stated need. You can deploy Apigee's runtime in a Google-managed project and connect it privately to the on-premises API through Cloud VPN or Cloud Interconnect, ensuring the legacy service is never directly exposed to the internet. External partners call an Apigee-managed HTTPS endpoint, while Apigee policies provide OAuth 2.0 enforcement, partner-specific quota management, and rich usage analytics without any code changes. Re-implementing the API on Cloud Functions would require redevelopment effort and a full migration. Forwarding traffic with an external TCP load balancer plus Cloud NAT would still leave OAuth, quota enforcement, and analytics to be implemented in the application stack, increasing maintenance. VPC Network Peering cannot make a private address reachable to an external partner and offers no API management features. Therefore, the Apigee-based approach is the only solution that satisfies all security and governance requirements while keeping operational overhead low.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.