Google Professional Cloud Network Engineer Question 577
Single answerGoogle Cloud PlatformYour organization has deployed a Google Cloud Virtual Private Cloud (VPC) with several private instances in a managed instance group. These instances need outbound internet access to download software updates, but you also need to monitor and audit the IP addresses used for NAT. What is the most appropriate way to configure Cloud NAT for this requirement?
- A
Use Cloud NAT with automatic NAT IP address assignment to allow dynamic IP allocation.
- B
Use Cloud NAT with manually assigned static IP addresses to ensure the IPs remain consistent for monitoring and auditing purposes.
- C
Configure Cloud NAT to use the external IP addresses allocated to the private instances.
- D
Use a default internet gateway instead of Cloud NAT for simpler management.
Show answer and explanation
Correct answer: B
Explanation
In scenarios where monitoring and auditing of NAT IP addresses are necessary, manually assigning static IPs to Cloud NAT is the best option. This ensures predictable and consistent IP addresses, simplifying logging and compliance requirements. Automatic NAT IP assignment does not provide this level of control, and using a default internet gateway or external IPs is either not possible or does not meet the requirements of the scenario.
- A. Incorrect.
Automatic NAT IP address assignment does not allow you to control or monitor the specific IP addresses being used, which is a requirement in this scenario.
- B. Correct.
Manually assigning static IP addresses in Cloud NAT ensures consistent and predictable NAT IPs for the private instances, making it easier to monitor and audit network traffic.
- C. Incorrect.
Cloud NAT cannot use external IP addresses from private instances, as private instances do not have external IPs by definition. Instead, Cloud NAT uses its own pool of IPs for translation.
- D. Incorrect.
A default internet gateway is not appropriate for private instances, as it does not ensure secure and controlled NAT functionality for outbound traffic.