Google Professional Cloud Security Engineer Question 276
Select 3Google Cloud PlatformYour company has deployed a hybrid cloud setup where some workloads are running on-premises, and others are running in Google Cloud. To ensure secure and private connectivity to Google APIs (such as Cloud Storage and BigQuery) from your on-premises environment, you need to configure appropriate services. Which combination of configurations would ensure private access to Google APIs from both on-premises and VPC resources in Google Cloud?
- A
Enable Private Google Access on the subnets hosting the workloads in the Google Cloud VPC.
- B
Set up Private Google Access for on-premises hosts by creating a Cloud NAT and routing on-premises traffic through the NAT.
- C
Enable restricted Google access to block access to all Google APIs except required services.
- D
Use Private Service Connect to create a private endpoint for accessing Google APIs from on-premises.
- E
Configure a direct peering or Cloud VPN/Interconnect between the on-premises environment and the Google Cloud VPC.
Show answer and explanation
Correct answers: A, B, E
Explanation
To establish private connectivity to Google APIs from both on-premises and Google Cloud VPC resources, you need to configure Private Google Access for the VPC subnets to allow VPC workloads to access Google APIs privately. For on-premises hosts, Private Google Access for on-premises must be configured by routing traffic through the Cloud NAT in the VPC. Additionally, connectivity between the on-premises environment and the VPC (e.g., via Cloud VPN, Interconnect, or direct peering) is required to enable this routing. Restricted Google access and Private Service Connect are not relevant to this scenario.
- A. Correct.
This is correct because enabling Private Google Access on Google Cloud VPC subnets allows workloads in those subnets to access Google APIs privately without using public IP addresses.
- B. Correct.
This is correct because Private Google Access for on-premises hosts allows on-premises systems to access Google APIs securely and privately when traffic is routed through the Google Cloud VPC using Cloud NAT.
- C. Incorrect.
This is incorrect because restricted Google access is used to limit access to Google APIs, not to establish private connectivity.
- D. Incorrect.
This is incorrect because Private Service Connect is typically used to connect to managed services or partner services privately and not specifically for accessing Google APIs from on-premises.
- E. Correct.
This is correct because establishing connectivity (using direct peering, Cloud VPN, or Interconnect) is required to route on-premises traffic to Google Cloud before using Private Google Access for on-premises hosts.