Choose two. A Google Cloud VPC needs to resolve an on-premises-only domain (corp.local). The on-prem DNS servers are reachable over Cloud VPN. Which two actions should be taken to allow GCP VMs to resolve corp.local?

To resolve on-premises-only domains like corp.local from Google Cloud VPC, you need to direct DNS queries for that domain to your on-premises DNS servers. The first correct option, "Create a Cloud DNS forwarding zone for corp.local that points to the on-prem DNS server IPs reachable over the VPN," establishes a forwarding rule within Cloud DNS. When a VM in your VPC queries corp.local, Cloud DNS will forward that request directly to the specified on-premises DNS servers over the VPN. The second correct option, "Configure Cloud DNS outbound forwarding endpoints with the on-prem resolver IPs and ensure routing/firewall rules allow access over the VPN," involves setting up outbound forwarding endpoints in your VPC. This creates an interface that Cloud DNS uses to send queries to external DNS servers, in this case, your on-premises ones. This method is often used when you want to control the source IP of the DNS queries leaving your VPC. "Create a public managed zone for corp.local" is incorrect because corp.local is an internal, non-public domain. Creating a public zone would not resolve internal records and could cause conflicts. "Use DNS peering zones" is incorrect because DNS peering is used to share DNS records between different VPC networks within Google Cloud, not for forwarding to external, on-premises DNS servers.