Google Professional Cloud Network Engineer Question 383
Select 2Google Cloud PlatformYour company hosts its applications on Google Cloud and uses Cloud NAT to provide internet access to virtual machines (VMs) in private subnets. Recently, your security team has mandated that all outbound traffic from these VMs must be restricted to specific APIs hosted by an external vendor, accessible via their fully qualified domain names (FQDNs). How can you implement this requirement in Google Cloud?
- A
Use FQDN-based firewall rules to allow outbound traffic to the vendor's FQDNs.
- B
Configure a Cloud NAT gateway and set up destination NAT rules for the vendor's FQDNs.
- C
Create a custom Google Cloud VPC firewall rule using FQDN objects to allow traffic to the vendor's FQDNs.
- D
Set up a proxy VM in the private subnet to resolve and enforce outbound requests to the vendor's FQDNs.
- E
Use Private Google Access to route traffic to the vendor's FQDNs.
Show answer and explanation
Correct answers: A, D
Explanation
To restrict outbound traffic to specific FQDNs, you can use FQDN-based firewall rules if supported, as they provide a straightforward solution. Alternatively, setting up a proxy VM allows you to enforce FQDN-based restrictions by resolving domain names and controlling requests at the application level. Other options, such as Cloud NAT or Private Google Access, do not directly address the requirement as they lack native support for FQDN-based restrictions.
- A. Correct.
Correct: FQDN-based firewall rules in Google Cloud allow you to specify domain names for controlling outbound traffic. This is the most direct way to implement the security team's requirement.
- B. Incorrect.
Incorrect: Cloud NAT does not support destination NAT or FQDN-based rules. It operates at the IP level and cannot natively enforce FQDN restrictions.
- C. Incorrect.
Incorrect: Google Cloud VPC firewall rules do not natively support FQDN objects. Firewall rules are typically based on IP addresses, protocols, and ports.
- D. Correct.
Correct: A proxy VM can be configured to resolve and enforce FQDN-based outbound traffic policies. This is a valid approach when FQDN-based firewall rules are not sufficient or applicable.
- E. Incorrect.
Incorrect: Private Google Access is used to route private traffic to Google APIs and services, not to external FQDNs.