Google Professional Cloud Network Engineer Question 281
Select 2Google Cloud PlatformYou are designing a hybrid cloud solution where VM instances in a Google Cloud VPC need to communicate privately with an on-premises network using non-overlapping private IP ranges. The on-premises network can only access IP ranges within its own private subnet. How can you implement Private NAT to meet this requirement?
- A
Create a Cloud NAT gateway with a private IP address and configure it to route traffic between the Google Cloud VPC and on-premises network.
- B
Configure a Private Service Connect endpoint to translate private IP addresses in the VPC to the on-premises private IP range.
- C
Set up a VM with private IP forwarding enabled and configure it as a NAT gateway to translate VPC private IPs to the private IP range of the on-premises network.
- D
Use Cloud Router to configure a route that translates the private IP addresses of the VPC to the private IP range of the on-premises network.
- E
Implement a custom Private NAT solution using iptables on a Compute Engine VM to handle address translation.
Show answer and explanation
Correct answers: C, E
Explanation
To implement Private NAT for translating private IP ranges between a Google Cloud VPC and an on-premises network, you can use a VM configured with private IP forwarding and NAT rules or a custom NAT solution using iptables on a Compute Engine VM. These approaches enable the translation of private IP addresses, which is required to ensure communication between the non-overlapping private IP ranges of the VPC and the on-premises network. Other options, such as Cloud NAT or Cloud Router, do not support this specific use case.
- A. Incorrect.
Cloud NAT does not support using private IP addresses for NAT translation. It is designed to provide outbound internet access for VM instances using public IP addresses.
- B. Incorrect.
Private Service Connect is used to connect services privately, such as accessing managed Google services or third-party services, but it does not provide NAT functionality for private IP address translation.
- C. Correct.
Enabling private IP forwarding on a VM and configuring it as a NAT gateway allows you to translate private IP addresses in the VPC to different private IP ranges, which meets the requirements of the scenario.
- D. Incorrect.
Cloud Router does not perform address translation. It is used for dynamic route advertisement and BGP peering, which are unrelated to NAT functionality.
- E. Correct.
Using a custom Private NAT solution with iptables on a Compute Engine VM can handle address translation between the VPC's private IP range and the on-premises private IP range, making it a valid solution.