Google Professional Cloud Network Engineer Question 213
Select 2Google Cloud PlatformYour organization is designing a new Google Cloud Virtual Private Cloud (VPC) environment to host multiple applications. The design requires creating a custom VPC with subnets that will span two regions. Additionally, one of the subnets must enable communication with Google-managed services such as Cloud Storage without exposing the subnet to the public internet. Which of the following actions should you take to meet these requirements?
- A
Create a custom VPC and define subnets in the desired regions, specifying the appropriate CIDR ranges for each subnet.
- B
Enable Private Google Access on the subnet that needs to communicate with Google-managed services.
- C
Configure a firewall rule to allow traffic to 0.0.0.0/0 for outbound communication from the subnet.
- D
Create a private services access subnet to enable communication with Google-managed services.
- E
Use a default VPC instead of creating a custom VPC to simplify the setup.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements, you need to create a custom VPC with subnets spanning the desired regions and enable Private Google Access on the subnet that requires communication with Google-managed services like Cloud Storage. This ensures secure communication without exposing the subnet to the public internet. Default VPCs or private services access subnets are not suitable for this use case.
- A. Correct.
Correct: Creating a custom VPC with subnets in the desired regions is necessary to meet the requirement of having subnets span multiple regions. You must also define appropriate CIDR ranges for each subnet.
- B. Correct.
Correct: Enabling Private Google Access ensures that the subnet can communicate with Google-managed services such as Cloud Storage without requiring public internet access.
- C. Incorrect.
Incorrect: Allowing traffic to 0.0.0.0/0 would expose the subnet to the public internet, which is explicitly not required in the scenario.
- D. Incorrect.
Incorrect: Creating a private services access subnet is specifically for enabling connectivity to Google APIs or services from a private IP range in hybrid or on-premises scenarios, not for subnets within a VPC to access Google-managed services.
- E. Incorrect.
Incorrect: Using a default VPC does not allow for custom configuration such as defining subnets across multiple regions or enabling Private Google Access.