Your company is moving its entire workload to Compute Engine. Some servers should be accessible through the Internet, and other servers should only…

The most effective and standard design on Google Cloud for this scenario is to use a single Virtual Private Cloud (VPC). A single VPC acts as a global, private networking space. Within this VPC, you create separate subnets to organize resources, such as one for the DMZ and one for the LAN. This provides IP address range separation. Crucially, security and traffic control are then managed by VPC firewall rules. You would create an ingress rule to allow specific public traffic to instances in the DMZ subnet (typically by applying a network tag like web-server). You would then create other firewall rules to strictly control traffic between the DMZ and LAN subnets, again using tags or service accounts for precise targeting. This approach is efficient, manageable, and a documented best practice.

B. This option is incorrect because it specifies allowing public egress traffic for the DMZ. While egress is needed, the critical rule for a public-facing service is the ingress rule that allows incoming traffic from the internet.
C. Using two separate VPCs introduces unnecessary complexity. Communication between VPCs requires VPC Network Peering, which has limitations. For instance, firewall rules in one VPC cannot use network tags from the peered VPC, forcing less flexible IP-based rules.
D. This option is incorrect for two reasons: it uses the more complex two-VPC design and incorrectly focuses on public egress traffic instead of the necessary public ingress rule for the DMZ.

1. Google Cloud Architecture Framework

Network design

VPC network segmentation: "For workloads that don't require the strict network isolation that's provided by separate VPC networks

use subnets and tags to create segmentation. This approach has the following benefits: Lower cost for network administration... Centralized control of firewall rules and routes in a single VPC network." This directly supports using subnets and tags within a single VPC (Option A) over separate VPCs (Option C) for this type of segmentation.

2. Google Cloud VPC Documentation

Use VPC firewall rules

Source and target filtering: "You can filter the sources for ingress rules and destinations for egress rules by using either network tags or service accounts." This highlights the flexibility of using tags within a single VPC

which is central to the solution in Option A.

3. Google Cloud VPC Documentation

VPC Network Peering

Details and properties: "Firewall rules. You cannot use network tags or service accounts from a peered VPC in a firewall rule." This statement confirms the limitation of the two-VPC approach (Option C)

making it less manageable than the single-VPC design where tags can be used freely.