Google Professional Cloud Network Engineer Question 82
Select 3Google Cloud PlatformYour organization has been assigned a public advertised prefix (PAP) by a regional internet registry. You want to allocate portions of this prefix to various projects in your Google Cloud environment while ensuring that external clients can reach certain resources using this public IP space. Additionally, you need to allow internal workloads to reach the internet using a private NAT gateway without exposing their private IP addresses. Which combination of actions should you take to meet these requirements?
- A
Create a public delegated prefix (PDP) from the public advertised prefix (PAP) and assign it to different projects or VPCs.
- B
Use Cloud NAT to allow private workloads to access the internet without exposing their private IP addresses.
- C
Configure a Private Google Access VPN for internal workloads to connect to the internet via the public advertised prefix.
- D
Use non-RFC 1918 private IP addresses for the workloads in the VPC to ensure compatibility with the public advertised prefix.
- E
Advertise the public delegated prefix (PDP) to external clients via a Google Cloud external load balancer.
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet the requirements, you need to allocate the public advertised prefix (PAP) into smaller public delegated prefixes (PDPs) for better IP management and assign them to projects or VPCs. Cloud NAT is used to allow private workloads to access the internet securely without exposing their private IPs. Finally, advertising the public delegated prefix via a Google Cloud external load balancer ensures external accessibility for specific resources. Using non-RFC 1918 private IP addresses or Private Google Access VPN is unnecessary in this case.
- A. Correct.
Correct. A public delegated prefix (PDP) allows you to allocate portions of your public advertised prefix (PAP) to specific projects or VPCs, enabling better IP management and segmentation.
- B. Correct.
Correct. Cloud NAT enables private workloads to access the internet without exposing their private IP addresses, which fulfills the requirement for secure internet connectivity.
- C. Incorrect.
Incorrect. Private Google Access VPN is not required or relevant for enabling internet access for internal workloads in this scenario.
- D. Incorrect.
Incorrect. Non-RFC 1918 private IP addresses are not necessary or recommended in this scenario. RFC 1918 private IP addresses are sufficient and compatible with the use of Cloud NAT and the public advertised prefix.
- E. Correct.
Correct. Advertising the public delegated prefix (PDP) via a Google Cloud external load balancer ensures that external clients can reach resources hosted in your environment using the public IP space.