GCP Professional Data Engineer Practice Question

Your company is migrating a 15 TB on-premises PostgreSQL database to Cloud SQL for PostgreSQL using Database Migration Service in continuous-sync mode that will run for six weeks. The on-premises data center has only commodity Internet connectivity and no dedicated circuits. Corporate policy requires all traffic to be encrypted in transit, and the migration must continue automatically if any single network link fails. Which networking solution best meets these requirements while minimizing operational effort?

Deploy High Availability Cloud VPN with two IPsec tunnels and dynamic BGP routing between the on-premises VPN gateway and a regional Cloud Router.
Configure VPC Network Peering between the on-premises network and the Google Cloud VPC that hosts Cloud SQL.
Order a Partner Interconnect attachment and rely on Cloud Interconnect encryption to secure the replication traffic.
Create a single-tunnel Classic Cloud VPN connection using static routing to advertise the on-premises subnets.

Report Issue

Answer Description

High Availability (HA) Cloud VPN automatically builds two independent IPsec tunnels that terminate in different Google Cloud zones behind a regional Cloud Router. Traffic is encrypted end-to-end over the public Internet, satisfying the encryption requirement. Because HA VPN provides 99.99 % service-level availability when both tunnels are established, DMS replication continues even if one tunnel or link fails, meeting the high-availability constraint without needing dedicated circuits. Classic (single-tunnel) Cloud VPN lacks redundancy, Partner Interconnect requires provisioning a dedicated connection and does not encrypt traffic by default, and VPC Network Peering cannot connect an on-premises network to a Google Cloud VPC, so these alternatives do not satisfy all stated requirements.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.