One project hosts three departments. Two departments need network connectivity between them; the third must be isolated. You need separate network admin domains and low operational overhead. Which design do you choose?

Creating three separate VPCs and connecting the two that need connectivity using VPC peering is the most suitable design. This approach provides distinct network administrative domains for each department, fulfilling the requirement for separation. VPC peering offers a low-latency, high-bandwidth connection between VPCs within the same or different projects, ensuring low operational overhead compared to managing VPN tunnels. The third isolated department remains completely separate in its own VPC. Using a Shared VPC host project would centralize network administration, which contradicts the need for separate admin domains. Creating three separate VPCs and connecting them with Cloud VPN would work, but VPC peering is generally preferred for intra-Google Cloud connectivity due to its simplicity, lower latency, and higher throughput, resulting in lower operational overhead. A single VPC with firewall rules and network tags would not provide separate network administrative domains, as all departments would share the same VPC and its routing table.