Google Professional Cloud Security Engineer Question 268
Select 3Google Cloud PlatformYour organization has multiple Google Cloud projects and an on-premises data center. You are tasked with enabling secure, private connectivity between your on-premises systems and Google Cloud services in multiple VPC networks. The organization uses Shared VPC to centralize networking, and you must ensure that your on-premises hosts can access Google Cloud APIs and services (e.g., Cloud Storage, BigQuery) privately. What steps should you take to achieve this?
- A
Configure a Cloud VPN or Cloud Interconnect connection between the on-premises network and the Shared VPC host project.
- B
Enable Private Google Access for on-premises hosts within the Shared VPC host project.
- C
Use VPC peering to connect the Shared VPC host project to the individual service projects.
- D
Ensure that the on-premises routes include the IP ranges for Google APIs and services (199.36.153.4/30 and 34.64.0.0/10).
- E
Enable Private Service Connect in the Shared VPC host project for all Google services.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enable secure, private connectivity between on-premises systems and Google Cloud services in a Shared VPC setup, you must first establish private connectivity using Cloud VPN or Cloud Interconnect. Then, enabling Private Google Access for on-premises ensures on-premises hosts can access Google APIs and services privately. Finally, you need to configure routes to ensure proper traffic flow to the Google API and service IP ranges. VPC peering is not required here because Shared VPC already centralizes networking, and Private Service Connect is not relevant to this requirement.
- A. Correct.
Correct. Cloud VPN or Cloud Interconnect is required to establish private connectivity between the on-premises network and the Shared VPC host project.
- B. Correct.
Correct. Private Google Access for on-premises ensures that on-premises hosts can privately access Google APIs and services without traversing the public internet.
- C. Incorrect.
Incorrect. VPC peering is used for connecting VPC networks directly. However, in this case, Shared VPC is already centralizing networking, and there is no need to use VPC peering between the Shared VPC host project and individual service projects.
- D. Correct.
Correct. To enable Private Google Access for on-premises, you must configure the appropriate routes to include the IP ranges for Google APIs and services.
- E. Incorrect.
Incorrect. Private Service Connect is not required for this scenario. It is typically used to connect to specific Google services or third-party services using private endpoints.