HA VPN and Cloud Router (default). On‑prem DNS at 192.168.20.88 behind a firewall. Compute Engine at 10.204.0.0/24 must resolve corp.altostrat.com while still resolving Google hostnames; follow Google best practices. What should you do?

The correct option uses a private forwarding zone in Cloud DNS to direct queries for corp.altostrat.com to the on-premises DNS server. This allows Compute Engine instances to resolve both internal and Google hostnames without modifying /etc/resolv.conf. The on-premises firewall must accept traffic from 35.199.192.0/19, which is the IP range used by Cloud DNS for forwarding. A custom route advertisement for 35.199.192.0/19 on the Cloud Router ensures the on-premises network knows how to route replies back to Cloud DNS. The first incorrect option incorrectly specifies the source IP range for the firewall and custom route advertisement as 10.204.0.0/24, which is the Compute Engine subnet, not the Cloud DNS forwarder. The third incorrect option suggests modifying /etc/resolv.conf, which is not a Google best practice as it can break resolution of Google-managed hostnames. The fourth incorrect option incorrectly describes the Cloud DNS configuration, mixing concepts of private zones and DNS policies in a way that doesn't achieve the desired forwarding.