Google Professional Cloud Security Engineer Question 277
Select 2Google Cloud PlatformYour organization has set up a hybrid cloud environment with on-premises workloads connecting to Google Cloud resources. You need to ensure that your on-premises systems can privately access Google APIs and services (e.g., BigQuery, Cloud Storage) without exposing traffic over the public internet. Which solution(s) should you implement to achieve this?
- A
Enable Private Google Access for on-premises hosts and configure a Cloud Interconnect or a VPN.
- B
Use Private Service Connect to create a private endpoint for Google APIs and route traffic through it.
- C
Enable Private Google Access on your Google Cloud subnets connected to your on-premises systems.
- D
Configure a NAT gateway in your Google Cloud VPC to route traffic to Google APIs over the public internet.
Show answer and explanation
Correct answers: A, B
Explanation
To establish private connectivity between on-premises systems and Google APIs, you can use Private Google Access for on-premises hosts via a VPN or Cloud Interconnect, or leverage Private Service Connect to create private endpoints for Google APIs. These solutions ensure traffic remains private and does not traverse the public internet. Enabling Private Google Access on Google Cloud subnets is not applicable for on-premises systems, and using a NAT gateway exposes traffic to the public internet, violating the requirement for private connectivity.
- A. Correct.
This is correct. Private Google Access for on-premises hosts allows on-prem systems to reach Google APIs and services privately when connected through a VPN or Cloud Interconnect.
- B. Correct.
This is correct. Private Service Connect can be used to create private endpoints for Google APIs, enabling private connectivity between on-premises systems and Google services.
- C. Incorrect.
This is incorrect. Enabling Private Google Access on Google Cloud subnets only applies to VM instances within Google Cloud, not to on-premises systems.
- D. Incorrect.
This is incorrect. Configuring a NAT gateway routes traffic over the public internet, which does not meet the requirement for private connectivity.