Google Professional Cloud Network Engineer Question 227
Select 2Google Cloud PlatformYour organization has a Virtual Private Cloud (VPC) in Google Cloud and uses only private IP addresses for its resources. The organization also needs to securely access Google APIs and services (e.g., Cloud Storage, BigQuery) without exposing traffic to the public internet. Which configuration steps are required to achieve this?
- A
Enable Private Google Access on the subnet where the resources are located.
- B
Create a Cloud NAT gateway for the subnet to allow private Google API access.
- C
Configure a private DNS zone with a custom domain to route traffic to Google APIs.
- D
Ensure that the desired Google APIs and services are enabled in the project.
- E
Set up a VPN or Interconnect for access to Google services.
Show answer and explanation
Correct answers: A, D
Explanation
To securely access Google APIs and services via private IP addresses, Private Google Access must be enabled on the subnet where the resources are located. Additionally, the specific Google APIs and services that the resources need to access must be enabled in the project. These configurations ensure secure and private connectivity to Google APIs without using public IPs or external NAT solutions.
- A. Correct.
Enabling Private Google Access on the subnet is required to allow private IPs in the VPC to reach Google APIs and services without using public IPs.
- B. Incorrect.
Cloud NAT is not required for Private Google Access. Private Google Access allows direct connectivity from private IPs to Google APIs and services without NAT.
- C. Incorrect.
Configuring a private DNS zone with a custom domain is not required for accessing Google APIs through Private Google Access. Google APIs are resolved automatically using default DNS configurations.
- D. Correct.
Google APIs and services must be enabled in the project for the resources to access them. Without enabling these services, Private Google Access will not function.
- E. Incorrect.
Setting up a VPN or Interconnect is not necessary for accessing Google APIs through Private Google Access. The traffic remains within Google's network.