Google Professional Cloud Network Engineer Question 283
Select 3Google Cloud PlatformYour company hosts a private application running on Compute Engine instances in a VPC subnet without external IP addresses. The application must connect to third-party APIs on the internet, but you want to ensure that the Compute Engine instances are not directly exposed to the internet. Which of the following steps do you need to take to implement Private NAT for this scenario?
- A
Create a Cloud NAT gateway and associate it with the subnet containing the Compute Engine instances.
- B
Ensure that the Compute Engine instances are assigned static external IP addresses.
- C
Configure routes in the VPC network to direct traffic from the subnet through the Cloud NAT gateway.
- D
Enable IP masquerading to allow instances in the subnet to use the Cloud NAT gateway for internet access.
- E
Verify that the Compute Engine instances have an appropriate firewall rule allowing egress traffic to the required destination IPs and ports.
Show answer and explanation
Correct answers: A, C, E
Explanation
To implement Private NAT, you need to deploy a Cloud NAT gateway and associate it with the subnet containing the private Compute Engine instances. This allows the instances to access the internet without requiring external IP addresses. Additionally, routes must be configured to ensure traffic flows through the NAT gateway, and appropriate firewall rules must be set up to permit outbound traffic. Assigning external IP addresses or manually configuring IP masquerading is not required for Private NAT.
- A. Correct.
Correct. A Cloud NAT gateway is necessary to provide internet access to instances in the private subnet without external IP addresses.
- B. Incorrect.
Incorrect. Assigning static external IP addresses defeats the purpose of using Private NAT to prevent exposing the instances to the internet.
- C. Correct.
Correct. Configuring routes ensures that traffic from the private subnet is directed through the Cloud NAT gateway for egress to the internet.
- D. Incorrect.
Incorrect. IP masquerading is automatically handled by Cloud NAT and does not require manual configuration for this use case.
- E. Correct.
Correct. Firewall rules are required to allow egress traffic from the Compute Engine instances to the internet destinations.