Google Professional Cloud Network Engineer Question 226
Single answerGoogle Cloud PlatformYour organization is running a fleet of virtual machines (VMs) in a private subnet within a VPC on Google Cloud. These VMs need to access Google APIs and services (e.g., Cloud Storage, BigQuery) without exposing them to the public internet. However, you also need to ensure that the VMs cannot access any other external IP addresses. Which configuration should you implement to meet these requirements?
- A
Enable Private Google Access on the subnet and configure a Cloud NAT gateway.
- B
Enable Private Google Access on the subnet and ensure the firewall rules block all egress traffic except to 0.0.0.0/0.
- C
Enable Private Google Access on the subnet and configure a route to 199.36.153.8/30.
- D
Enable Private Google Access on the subnet and ensure there are no internet egress routes in the VPC.
Show answer and explanation
Correct answer: C
Explanation
To allow VMs in a private subnet to access Google APIs and services without using the public internet, you must enable Private Google Access. This feature ensures that the VMs can communicate with Google APIs using internal IPs within the Google network. Additionally, to restrict VMs from accessing any other external IPs, you must configure a specific route to the Google Private Access IP range (199.36.153.8/30) and ensure no default internet egress routes exist. This configuration meets the requirement of accessing only Google services while avoiding exposure to external IPs.
- A. Incorrect.
This is incorrect because while Private Google Access allows VMs to access Google APIs using private IPs, Cloud NAT is not necessary for accessing Google APIs when Private Google Access is enabled.
- B. Incorrect.
This is incorrect because blocking egress traffic except to 0.0.0.0/0 does not align with the requirement. Additionally, 0.0.0.0/0 is the default route for all external traffic, which would expose the VMs to the public internet.
- C. Correct.
This is correct because enabling Private Google Access allows VMs to access Google APIs via internal IPs, and the route to 199.36.153.8/30 ensures that only Google APIs are accessible while preventing access to all other external IPs.
- D. Incorrect.
This is incorrect because simply enabling Private Google Access and removing internet egress routes would block all external traffic, including Google APIs, unless a specific route for Google APIs (e.g., 199.36.153.8/30) is added.