Google Professional Cloud Security Engineer Question 266
Select 3Google Cloud PlatformYour organization has an on-premises data center that requires private connectivity to workloads running in multiple Google Cloud projects. The organization uses Shared VPC to manage networking resources centrally, and the on-premises data center is connected to the Shared VPC host project using a Cloud VPN. You need to ensure that on-premises hosts can privately access Google APIs and services (such as Cloud Storage and BigQuery) without exposure to the public internet. Which configuration steps should you take?
- A
Enable Private Google Access for on-premises hosts in the Shared VPC host project.
- B
Ensure the Cloud VPN has a valid route to the IP range 199.36.153.4/30, which is used for Private Google Access.
- C
Configure Private Google Access in all service projects attached to the Shared VPC.
- D
Create a custom static route in the Shared VPC host project that directs traffic destined for 199.36.153.4/30 to the on-premises VPN gateway.
- E
Configure DNS to resolve Google service domains (e.g., *.googleapis.com) to their private IP addresses.
Show answer and explanation
Correct answers: A, B, E
Explanation
To enable private connectivity between on-premises hosts and Google services, you must configure Private Google Access for on-premises hosts in the Shared VPC host project, ensure that the Cloud VPN has a route to the required IP range (199.36.153.4/30), and configure DNS so that Google service domains resolve to private IP addresses. These steps ensure that traffic destined for Google APIs and services remains private and avoids the public internet. Configurations like enabling Private Google Access in service projects or creating custom static routes are either unnecessary or not applicable in this scenario.
- A. Correct.
Correct: Private Google Access for on-premises hosts must be enabled in the Shared VPC host project to allow private access to Google APIs and services from on-premises systems.
- B. Correct.
Correct: The 199.36.153.4/30 IP range is required for Private Google Access from on-premises hosts, and the Cloud VPN must have a valid route to this range.
- C. Incorrect.
Incorrect: Private Google Access for service projects is only required for Google Cloud workloads within those projects, not for on-premises access.
- D. Incorrect.
Incorrect: A custom static route to 199.36.153.4/30 is unnecessary because Google Cloud automatically handles routing for Private Google Access when properly configured.
- E. Correct.
Correct: DNS must resolve Google service domains to private IP addresses to ensure that traffic does not go through the public internet.