Google ACE Practice Question: Planning a GCP network for a company with offices…

You are planning a GCP network for a company with offices in three regions: `us-central1`, `europe-west1`, and `asia-east1`. All three regions must communicate with each other, and traffic must NOT traverse the public internet. Each region has its own subnet. Which network design achieves this with the least management overhead?

⚠ Common exam trap

The trap here is that candidates often overcomplicate the solution by thinking they need separate VPCs or VPNs for each region, not realizing that a single global VPC inherently supports multi-region subnets with private, Google-managed routing.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use a single global VPC with subnets in each region; traffic between subnets stays on Google's private network.

A single global VPC allows you to create subnets in multiple regions, and traffic between those subnets stays on Google's private backbone network without traversing the public internet. This design requires no additional connectivity configuration, peering, or VPN tunnels, making it the simplest to manage while meeting all requirements.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create three separate VPCs (one per region) and connect them with VPC Network Peering.
Why it's wrong here
VPC Network Peering connects two distinct VPC networks so that their internal IP addresses can communicate, but peering is not transitive and routes are not automatically propagated beyond the peer. To connect three regional VPCs you would need to create three peerings (full mesh) and administer the corresponding route advertisements and firewall rules. In contrast, a single global VPC already gives you regional subnets with automatic routing between them, so peering merely adds operational overhead without any technical advantage.
✓
Use a single global VPC with subnets in each region; traffic between subnets stays on Google's private network.
Why this is correct
A VPC network is a global resource; its subnets can be placed in any region. Instances in different regional subnets communicate using their internal IPv4 addresses, with traffic forwarding handled automatically by the VPC's dynamic routes. Because the underlying links between regions traverse Google's private backbone, this requires no VPNs, peering, or Interconnect attachments, giving low latency and no additional configuration.
✗
Set up Cloud VPN tunnels between each pair of regions.
Why it's wrong here
Cloud VPN creates encrypted tunnels between a Google Cloud VPC and an external network such as an on-premises datacenter or another cloud provider. Using it to connect regions inside the same VPC is unnecessary because the VPC already provides connectivity between regional subnets. Moreover, a mesh of VPN tunnels between every region pair adds complexity, latency from encryption, and duplicate management, while providing no benefit over native VPC routing.
✗
Use Cloud Interconnect dedicated connections in each region and configure BGP routing between them.
Why it's wrong here
Cloud Interconnect provides dedicated, high-bandwidth connections between your on-premises network and Google's edge, usually with BGP sessions to exchange routes. It is designed for hybrid cloud scenarios, not for connecting GCP regions to each other. Configuring Interconnect in each region and running BGP between them would bypass the VPC's internal routing and add physical infrastructure costs, while the VPC already handles inter-region traffic over Google's backbone with no extra hardware.

Visual reference

Go deeper

Google ACE Practice Question: Planning a GCP network for a company with offices…

Why each option matters

Option-by-option breakdown

Related to this question