Google Professional Cloud Security Engineer Question 264
Select 3Google Cloud PlatformYour company has a Google Cloud environment with multiple projects and a Shared VPC setup. On-premises servers require private access to Google APIs (e.g., BigQuery and Cloud Storage) without traversing the public internet. Which steps should you take to ensure proper connectivity between the on-premises network and Google APIs?
- A
Enable Private Google Access on the Shared VPC subnets used by on-premises traffic.
- B
Configure VPC Network Peering between the on-premises network and the Shared VPC network.
- C
Set up Cloud VPN or Cloud Interconnect to establish connectivity between the on-premises network and the Shared VPC.
- D
Ensure that on-premises DNS resolves *.googleapis.com to private IP addresses using the Private Google Access DNS zones.
- E
Enable the 'Private Services Access' feature in the Shared VPC network.
Show answer and explanation
Correct answers: A, C, D
Explanation
To allow on-premises hosts to access Google APIs privately, you must enable Private Google Access on the Shared VPC subnets to permit private access to Google APIs. Additionally, a private connection (Cloud VPN or Cloud Interconnect) between the on-premises network and the Shared VPC is required. Finally, DNS for *.googleapis.com must resolve to the appropriate private IP addresses. These steps ensure secure and private communication with Google APIs without using the public internet.
- A. Correct.
Enabling Private Google Access on the Shared VPC subnets ensures that instances in those subnets, including on-premises hosts that route through these subnets, can access Google APIs privately.
- B. Incorrect.
VPC Network Peering is not used to connect on-premises networks to Google Cloud. Instead, you need to use Cloud VPN or Cloud Interconnect for such connectivity.
- C. Correct.
Cloud VPN or Cloud Interconnect is necessary to establish a private connection between the on-premises network and the Shared VPC.
- D. Correct.
Configuring DNS to resolve *.googleapis.com to private IPs is required to ensure traffic to Google APIs remains private and doesn't traverse the public internet.
- E. Incorrect.
Private Services Access is a feature used for enabling private connectivity to Google-managed services like Cloud SQL, but it is not required for accessing Google APIs via Private Google Access.