Google Professional Cloud Network Engineer Question 715
Select 2Google Cloud PlatformYour organization uses Cloud NAT to allow VMs in a private VPC subnet to access the internet without exposing their private IP addresses. Recently, users have reported connectivity issues when accessing external APIs. You need to diagnose the issue. Which of the following actions should you take to enable and review the appropriate logs for troubleshooting?
- A
Enable VPC Flow Logs for the subnet associated with the affected VMs.
- B
Enable Cloud NAT logging in the NAT configuration settings.
- C
Enable Cloud Router logging for the router associated with the NAT gateway.
- D
Review Firewall Insights to identify if any firewall rules are blocking the traffic.
- E
Enable Cloud VPN logging to track the internet traffic.
Show answer and explanation
Correct answers: A, B
Explanation
To diagnose connectivity issues with Cloud NAT, you need to focus on tools that provide visibility into network traffic and NAT operations. Enabling VPC Flow Logs captures detailed traffic flow data, while enabling Cloud NAT logging provides specific insights into NAT translations and errors. These two actions together allow you to effectively troubleshoot the problem. Other options, like Cloud Router logging, Firewall Insights, and Cloud VPN logging, are unrelated to the issue described in the scenario.
- A. Correct.
Enabling VPC Flow Logs for the subnet allows you to capture detailed information about the network traffic to and from the VM instances, which can aid in diagnosing connectivity issues.
- B. Correct.
Cloud NAT logging must be explicitly enabled to gain insights into NAT gateway traffic, including translation details and errors. This is a critical step when troubleshooting NAT-related connectivity issues.
- C. Incorrect.
Cloud Router logging is used for dynamic routing updates and BGP sessions but does not provide insights into NAT traffic. Therefore, it is not relevant in this scenario.
- D. Incorrect.
Firewall Insights is useful for analyzing the effectiveness of firewall rules but does not provide specific insights into NAT or connectivity issues related to internet egress traffic.
- E. Incorrect.
Cloud VPN logging is used for troubleshooting issues with VPN tunnels, which is not applicable since the problem involves internet egress, not VPN connections.