Google Professional Cloud Network Engineer Question 599
Select 2Google Cloud PlatformYou are managing a Google Cloud project that hosts a private application on Compute Engine virtual machines (VMs) in a private subnet. The VMs need to access external APIs on the internet, but they must not have external IP addresses assigned. To achieve this, you decide to use Private NAT. Which of the following configurations must you implement to enable this setup?
- A
Create a Cloud NAT gateway and configure it with a private IP address from the subnet.
- B
Ensure that the VMs are in a subnet that has Private Google Access enabled.
- C
Configure the Cloud NAT gateway to use manual NAT IP address allocation with a /32 external IP range.
- D
Associate the Cloud NAT gateway with the correct VPC network and region.
- E
Enable IP forwarding on the VMs to route traffic through the NAT gateway.
Show answer and explanation
Correct answers: B, D
Explanation
To allow instances in a private subnet to access external resources without assigning them public IPs, you must configure a Cloud NAT gateway. The gateway requires an association with the correct VPC network and region, and Private Google Access must be enabled to allow access to Google APIs. Additionally, Cloud NAT relies on external IP addresses, not private IPs, and there is no requirement to enable IP forwarding for this use case.
- A. Incorrect.
Incorrect: Cloud NAT does not use private IP addresses; it requires external IP addresses to allow outbound internet access for private resources.
- B. Correct.
Correct: Enabling Private Google Access allows the VMs in the private subnet to reach Google APIs and services through internal IPs, which is necessary for this setup.
- C. Incorrect.
Incorrect: Cloud NAT does not support manual NAT IP address allocation with a /32 range. It requires public external IP ranges for NAT functionality.
- D. Correct.
Correct: A Cloud NAT gateway must be associated with the correct VPC network and region to ensure it can process traffic from the VMs in the private subnet.
- E. Incorrect.
Incorrect: Enabling IP forwarding is not necessary for this scenario because VMs can use the Cloud NAT gateway directly without additional forwarding configurations.