Google Professional Cloud Network Engineer Question 591
Single answerGoogle Cloud PlatformYou are a Professional Cloud Network Engineer tasked with configuring Cloud NAT in your organization. However, your organization has a policy that restricts the use of external IP addresses for Compute Engine VMs. To comply with this policy, you need to ensure that Compute Engine instances can access the internet only through Cloud NAT and not directly using external IPs. Which organization policy constraint should you configure to achieve this?
- A
compute.restrictVpnUsage
- B
compute.disableExternalIp
- C
compute.requireOsLogin
- D
compute.disableCloudNAT
Show answer and explanation
Correct answer: B
Explanation
To ensure that Compute Engine instances access the internet only through Cloud NAT, you need to disable the use of external IP addresses for VMs. The organization policy constraint compute.disableExternalIp enforces this restriction. By enabling this constraint, you prevent the assignment of external IPs to VMs, thereby requiring all internet-bound traffic to pass through Cloud NAT for egress.
- A. Incorrect.
This constraint is unrelated to the use of external IP addresses or Cloud NAT. It governs VPN usage restrictions.
- B. Correct.
This is the correct organization policy constraint. It disables the use of external IP addresses, ensuring that VMs access the internet only through mechanisms such as Cloud NAT.
- C. Incorrect.
This constraint is related to requiring OS Login for VM instances and has no impact on external IP address usage or Cloud NAT.
- D. Incorrect.
This constraint does not exist. Cloud NAT is a feature of Google Cloud, and there is no organization policy to disable it.