Google Professional Cloud Network Engineer Question 593
Single answerGoogle Cloud PlatformYour organization requires all Cloud NAT configurations to use specific IP ranges for external NAT IP addresses, and you need to enforce this across all projects in the organization. Which organization policy constraint should you configure to meet this requirement?
- A
constraints/compute.requireOsLogin
- B
constraints/compute.restrictCloudNATUsage
- C
constraints/compute.restrictExternalIPs
- D
constraints/compute.restrictCloudNATIpRanges
Show answer and explanation
Correct answer: D
Explanation
To enforce specific IP ranges for external NAT IP addresses across all projects in an organization, you must configure the 'constraints/compute.restrictCloudNATIpRanges' organization policy. This constraint ensures that only the allowed IP ranges can be used for Cloud NAT, supporting compliance and security requirements. Other options are either incorrect or unrelated to Cloud NAT configurations.
- A. Incorrect.
This constraint enforces the use of OS Login for VM instances and is unrelated to Cloud NAT or its IP address configuration.
- B. Incorrect.
This constraint does not exist. It is a distractor and not a valid organization policy constraint.
- C. Incorrect.
This constraint restricts the use of external IPs for VM instances but does not manage the IP ranges used by Cloud NAT.
- D. Correct.
This is the correct constraint that allows you to enforce specific IP ranges for external NAT IP addresses used by Cloud NAT across the organization.