Google Professional Cloud Network Engineer Question 212
Select 4Google Cloud PlatformYou are designing a new Google Cloud Virtual Private Cloud (VPC) for your company. The VPC will host multiple workloads across different regions. The workloads must communicate with each other internally and also require access to a private Google service, such as Cloud SQL, without exposing their traffic to the public internet. Which of the following steps should you take to correctly implement this setup?
- A
Create a custom-mode VPC and define subnets in the required regions.
- B
Set up firewall rules to allow internal communication between subnets in the VPC.
- C
Enable Private Google Access on each subnet to allow access to Google services over private IPs.
- D
Create a Cloud VPN gateway to connect the VPC to Google services privately.
- E
Create a private services access subnet for Google services.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To implement a VPC that supports internal workload communication and access to private Google services, you must create a custom-mode VPC with subnets in the necessary regions, configure firewall rules for internal communication, enable Private Google Access for subnets, and create a private services access subnet. Cloud VPN is not relevant in this case, as the traffic does not involve external networks.
- A. Correct.
Correct: A custom-mode VPC allows you to define subnets in the regions where your workloads will run, ensuring proper segmentation and control over IP ranges.
- B. Correct.
Correct: Firewall rules are necessary to allow internal communication between subnets, as Google Cloud blocks most traffic by default.
- C. Correct.
Correct: Enabling Private Google Access on subnets allows resources in those subnets to communicate with supported Google services over private IPs, avoiding public internet exposure.
- D. Incorrect.
Incorrect: A Cloud VPN gateway is not required for this scenario, as private Google services access does not involve connecting to external networks.
- E. Correct.
Correct: A private services access subnet is required to establish connectivity to Google-managed services like Cloud SQL via private IPs.