A financial services firm wants every packet leaving one spoke subnet to pass through a third-party deep-packet inspection appliance. The appliances run on several VMs that must scale out. Which construct lets the VPC steer traffic into that appliance pool?
Show answer and explanation
Answer: A
A custom static route can name an internal passthrough Network Load Balancer as its next hop. Traffic matching the route is sent to the load balancer, which distributes flows across the inspection appliance VMs. This gives a scalable, highly available pool of third-party appliances inside the VPC. Cloud Router only exchanges BGP routes with external peers, so it does not steer traffic into appliances. Firewall logging records decisions but does not forward packets, and Cloud NAT translates addresses rather than inspecting payloads.
Why the other options are wrong
- B. Cloud Router advertises routes to BGP peers such as on-premises routers. It does not place a VPC route's next hop into an inspection appliance pool inside the network.
- C. Firewall logging captures allow and deny records for analysis. It cannot redirect packets through a third-party appliance, so it does not perform inline inspection.
- D. Cloud NAT translates source addresses for private VMs going to the internet. A custom port range does not insert an inspection appliance into the data path.