Google Professional Cloud Security Engineer Question 240
Select 3Google Cloud PlatformYour organization has a Shared VPC setup within Google Cloud where the host project contains multiple service projects. You are tasked with ensuring that all traffic between the service projects and the host project remains private while also allowing the service projects to access specific external APIs. Which of the following configurations should you implement to meet these requirements?
- A
Enable Private Google Access on the subnets in the service projects.
- B
Set up VPC Peering between the host project and each service project.
- C
Configure firewall rules to explicitly deny all egress traffic except for the required API IP ranges.
- D
Ensure that all subnets in the Shared VPC are configured with internal IP ranges only.
- E
Use Private Service Connect to configure access to the external APIs.
Show answer and explanation
Correct answers: A, C, E
Explanation
To ensure private communication between the host and service projects in a Shared VPC setup and to allow access to specific external APIs, you need to enable Private Google Access for private API communication, restrict egress traffic using firewall rules, and leverage Private Service Connect for secure API access. VPC Peering is unnecessary as the Shared VPC already facilitates connectivity between the host and service projects, and merely using internal IP ranges does not address API access requirements.
- A. Correct.
Correct. Enabling Private Google Access ensures that instances without external IP addresses in the service projects can privately access Google APIs and services, which is critical for maintaining private communication.
- B. Incorrect.
Incorrect. VPC Peering is unnecessary in a Shared VPC setup because the service projects already share the same VPC network with the host project.
- C. Correct.
Correct. Creating explicit egress firewall rules allows you to restrict traffic to only the necessary external API IP ranges, ensuring security while maintaining access.
- D. Incorrect.
Incorrect. While internal IP ranges are good for private subnets, this option does not address the requirement to access specific external APIs.
- E. Correct.
Correct. Private Service Connect allows secure, private access to external APIs without exposing traffic to the public internet, aligning with the requirements.