Google Professional Cloud Network Engineer Question 148
Select 3Google Cloud PlatformYour organization needs to securely access Google Cloud APIs (such as BigQuery and Cloud Storage) from an on-premises environment without exposing traffic to the public internet. You are tasked with designing this access using Private Service Connect. Which steps are required to configure this setup?
- A
Create a Private Service Connect endpoint in the VPC network that connects to Google APIs.
- B
Configure DNS to resolve the Google API domain names to the Private Service Connect endpoint's internal IP address.
- C
Create a Cloud VPN or Cloud Interconnect connection from the on-premises environment to the VPC.
- D
Enable VPC Service Controls and define appropriate service perimeters.
- E
Grant the service account used on-premises access to the required Google Cloud APIs.
Show answer and explanation
Correct answers: A, B, C
Explanation
To access Google APIs privately from an on-premises location, you need to configure Private Service Connect to route traffic through a private endpoint in your VPC. This requires creating a Private Service Connect endpoint, updating DNS to resolve API domain names to the endpoint's internal IP address, and establishing secure connectivity between the on-premises network and the VPC using Cloud VPN or Cloud Interconnect. Additional steps like enabling VPC Service Controls or configuring service account permissions are useful but not mandatory for this specific network setup.
- A. Correct.
Correct: Private Service Connect allows you to create endpoints in your VPC that privately route traffic to Google APIs and services. This step is essential to set up a secure connection.
- B. Correct.
Correct: To ensure API traffic is routed through the Private Service Connect endpoint, you need to configure DNS such that API domain names resolve to the internal IP address of the endpoint.
- C. Correct.
Correct: A Cloud VPN or Cloud Interconnect is necessary to securely connect your on-premises environment to the VPC in Google Cloud where the Private Service Connect endpoint resides.
- D. Incorrect.
Incorrect: While VPC Service Controls can enhance security by defining service perimeters, they are not a mandatory step for accessing Google APIs via Private Service Connect.
- E. Incorrect.
Incorrect: Granting API access to the service account is necessary for using the APIs, but it is unrelated to the network connectivity required to access Google APIs privately.