Google Professional Cloud Network Engineer Question 596
Select 3Google Cloud PlatformYou are tasked with setting up a Private NAT configuration for workloads in a private subnet of your VPC. The goal is to allow these workloads to access the public internet securely for downloading updates while ensuring their private IP addresses are not exposed. Which of the following steps are required to configure this solution correctly?
- A
Create a Cloud NAT gateway in the same region as your private subnet and associate it with a router.
- B
Enable IP forwarding on the virtual machine instances in the private subnet.
- C
Configure the Cloud NAT gateway to use a custom NAT IP address.
- D
Ensure the private subnet has a default internet gateway route (0.0.0.0/0) pointing to the Cloud NAT gateway.
- E
Create a firewall rule allowing egress traffic from the private subnet to the internet.
Show answer and explanation
Correct answers: A, C, E
Explanation
To configure Private NAT with Google Cloud NAT, you need to create a Cloud NAT gateway associated with a router in the same region as the private subnet. Configuring the NAT gateway with a custom NAT IP address is optional but valid. Additionally, a firewall rule allowing egress traffic to the internet is essential. However, there is no requirement to enable IP forwarding on private subnet instances, and Cloud NAT does not depend on a default internet gateway route, as it works seamlessly with the private subnet's default route.
- A. Correct.
Correct: Creating a Cloud NAT gateway in the same region as the private subnet and associating it with a router is a required step for enabling Private NAT.
- B. Incorrect.
Incorrect: IP forwarding is not required for instances in the private subnet when using Cloud NAT. It is typically used for configuring packet forwarding in other scenarios.
- C. Correct.
Correct: Using a custom NAT IP address is an optional but valid configuration for Cloud NAT. This allows you to specify the external IP addresses used for NAT translation.
- D. Incorrect.
Incorrect: Cloud NAT does not require a default internet gateway route. Instead, it works with the private subnet’s existing default route to the default internet gateway.
- E. Correct.
Correct: A firewall rule permitting egress traffic from the private subnet to the internet is necessary for the instances to send traffic out.