Professional Cloud ArchitectDesign and plan a cloud solution architectureHard
A healthcare organization is migrating a legacy on-premises application to Google Cloud. The application uses sensitive patient data and must comply with strict regulatory requirements, including data residency and isolation. The organization needs to ensure that the application's network traffic and data are completely isolated from the public internet and other Google Cloud customers, even for administrative access. Which Google Cloud networking approach provides the strongest isolation and control for this scenario?
- ADedicated Interconnect with Private Google Access.
- BShared VPC with Private Google Access.
- CIsolated VPC with Private Google Access, deployed in a dedicated organization.
- DVPC Service Controls with Private Google Access.
Show answer & explanationAnswer & explanation
Correct answer: A. Dedicated Interconnect with Private Google Access.
Dedicated Interconnect creates a physical, private connection between the customer's on-premises network and Google's network, bypassing the public internet entirely. Combined with Private Google Access, this ensures all traffic, including API access, remains on Google's private network, fulfilling the strongest isolation requirement.
Why the other options are wrong
- B. Shared VPC allows multiple projects to share a common VPC network but doesn't provide the physical isolation from the public internet required for extreme sensitivity.
- C. An 'Isolated VPC' is not a standard Google Cloud product or feature. While a dedicated organization helps with administrative isolation, it doesn't inherently provide the network isolation from the public internet that Dedicated Interconnect does.
- D. VPC Service Controls create security perimeters to prevent data exfiltration but don't provide physical isolation from the public internet for the connection itself. Private Google Access routes internal traffic but doesn't guarantee the initial connection is fully private.
Dedicated Interconnect
A physical, direct connection between your on-premises network and Google's network, providing high-bandwidth, low-latency private connectivity that bypasses the public internet.
- Physical, private network connection
- Bypasses the public internet
- Offers high bandwidth and predictable latency
Memory trick: Dedicated Interconnect is your private, direct, unshared highway to Google.