Google Associate Cloud Engineer Question 278
Select 2Google Cloud PlatformYou are managing a VPC network in Google Cloud Platform that hosts a private web application. The application servers need to access the internet to download software updates, but they should not be directly accessible from the internet. How can you configure this setup using Cloud NAT and Cloud DNS?
- A
A. Use Cloud NAT to allow the application servers to initiate outbound connections to the internet without exposing their private IPs.
- B
B. Use Cloud DNS to create a private DNS zone for the web application.
- C
C. Use Cloud NAT to map the private IPs of the application servers to public IPs for inbound connections.
- D
D. Use Cloud DNS to create a public DNS zone for the web application to be accessible from the internet.
- E
E. Use an external load balancer to handle the traffic between the application servers and the internet.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure the application servers can access the internet without being exposed, Cloud NAT should be used to manage outbound connections. This allows the servers to download updates without having public IPs. Additionally, creating a private DNS zone with Cloud DNS allows internal name resolution within the VPC, keeping the application internal and private.
- A. Correct.
A. Correct: Cloud NAT allows resources in a private VPC to access the internet for outbound communication without exposing their private IP addresses.
- B. Correct.
B. Correct: Creating a private DNS zone allows internal resources to resolve domain names within the VPC without exposing them to the internet.
- C. Incorrect.
C. Incorrect: Cloud NAT is not used for inbound connections; it is designed for outbound traffic from private IPs.
- D. Incorrect.
D. Incorrect: A public DNS zone would expose the application to the internet, which contradicts the requirement of keeping it private.
- E. Incorrect.
E. Incorrect: An external load balancer is used for managing inbound traffic and does not help in initiating outbound internet connections from private servers.