Google Professional Cloud Network Engineer Question 90
Single answerGoogle Cloud PlatformYour organization uses a private subnet range defined by RFC 1918 to host internal services in Google Cloud. You are tasked with enabling access to Google-managed services (such as Cloud Storage and BigQuery) without exposing your internal resources to the public internet. Which solution should you implement?
- A
Configure a Cloud NAT gateway for the private subnet to enable internet access for all resources.
- B
Set up Private Google Access for the subnet to allow access to Google APIs and services using internal IPs.
- C
Use VPC Service Controls to restrict data exfiltration to Google-managed services.
- D
Enable an external IP on your VM instances for accessing Google APIs and services.
Show answer and explanation
Correct answer: B
Explanation
The correct solution is to enable Private Google Access for the private subnet. This feature allows resources using RFC 1918 IP ranges to access Google-managed services without requiring external IPs or routing traffic through the public internet. This ensures both security and compliance with the use of private IP addresses.
- A. Incorrect.
Configuring a Cloud NAT gateway enables outbound internet access for private resources but does not specifically enable access to Google APIs and services using only internal IPs.
- B. Correct.
Setting up Private Google Access allows resources in a private subnet using RFC 1918 IP ranges to access Google APIs and services (e.g., Cloud Storage, BigQuery) without requiring external IP addresses. This is the correct solution.
- C. Incorrect.
VPC Service Controls enhance data security by adding boundaries around Google-managed resources but do not directly enable access to Google APIs and services from private subnets.
- D. Incorrect.
Enabling external IPs on VM instances exposes them to the public internet, which is unnecessary and reduces security when accessing Google APIs and services from private subnets.