Google Professional Cloud Network Engineer Question 155
Single answerGoogle Cloud PlatformYou are designing a hybrid connectivity solution for your company's on-premises network and Google Cloud. The company has multiple projects in a host-project model using VPC Network Peering to connect the projects. One of the projects needs to access Google-managed services like Cloud SQL and BigQuery via private IP addresses. How should you configure access to these services while ensuring scalability and maintaining network communication across peered VPCs?
- A
Use VPC Network Peering to directly route traffic to Google-managed services in the target project.
- B
Configure Private Service Connect to create private endpoints for accessing Google-managed services.
- C
Enable Private Google Access in the VPC and set up Private Service Access for the required Google-managed service.
- D
Use Shared VPC to create a centralized network and configure Private Google Access in the shared host project.
Show answer and explanation
Correct answer: C
Explanation
To access Google-managed services such as Cloud SQL and BigQuery using private IPs, you must configure Private Service Access and enable Private Google Access in the VPC. This ensures traffic to these services remains internal and does not traverse the public internet. VPC Network Peering by itself does not support direct access to Google-managed services, and Shared VPC centralization does not eliminate the need for specific configurations for private connectivity.
- A. Incorrect.
VPC Network Peering does not support directly routing traffic to Google-managed services like Cloud SQL or BigQuery. These services require Private Google Access or Private Service Connect for private IP-based access.
- B. Incorrect.
Although Private Service Connect can create private endpoints for accessing Google-managed services, it is more suitable for connecting to third-party services or Google APIs in a highly controlled manner. The question specifically asks about accessing Google-managed services like Cloud SQL using private IPs, which is better handled with Private Services Access.
- C. Correct.
Enabling Private Google Access in the VPC and setting up Private Service Access allows the project to access Google-managed services like Cloud SQL using internal IPs. This is the recommended approach for private connectivity to Google-managed services.
- D. Incorrect.
Shared VPC centralizes network management but does not inherently provide private access to Google-managed services. Private Google Access and/or Private Service Access configurations are still required for these services.