Google Professional Cloud Network Engineer Question 284
Select 3Google Cloud PlatformYou are tasked with setting up a Private NAT configuration in Google Cloud to ensure instances in a private subnet can access external resources over the internet without exposing their private IPs. Which steps should you take to implement this functionality?
- A
Create a Cloud NAT gateway and associate it with the appropriate VPC network and subnet.
- B
Ensure the instances in the private subnet have an external IP address assigned.
- C
Configure the Cloud NAT gateway to use a designated NAT IP range or automatically allocate NAT IP addresses.
- D
Enable Private Google Access on the private subnet.
- E
Modify the firewall rules to allow egress traffic from the private subnet.
Show answer and explanation
Correct answers: A, C, E
Explanation
To implement Private NAT, you must create a Cloud NAT gateway and associate it with the appropriate VPC and subnet. This gateway performs the necessary IP translation for outbound internet traffic without exposing the private IPs of the instances. Configuring the NAT gateway's IP allocation ensures proper translation. Finally, appropriate firewall rules must allow egress traffic from the private subnet to the NAT gateway. Instances within the private subnet should not have external IPs, as this defeats the purpose of using Private NAT. Enabling Private Google Access is unrelated to this specific scenario since it is used for accessing Google APIs and services.
- A. Correct.
Correct. A Cloud NAT gateway is required to perform Network Address Translation for traffic originating from instances in a private subnet. Associating it with the VPC and subnet ensures traffic from those instances is routed correctly.
- B. Incorrect.
Incorrect. Instances in the private subnet should not have external IP addresses, as the purpose of Private NAT is to allow internet access without exposing private IPs.
- C. Correct.
Correct. Configuring the NAT gateway with a NAT IP range or allowing it to automatically allocate IPs ensures the gateway can translate private IPs to public IPs for outgoing traffic.
- D. Incorrect.
Incorrect. While enabling Private Google Access is important for accessing Google APIs and services, it is not required for implementing Private NAT for general internet traffic.
- E. Correct.
Correct. Firewall rules must allow egress traffic from the private subnet to ensure traffic can leave the subnet and be processed by the NAT gateway.