Google Professional Cloud Security Engineer Question 278
Select 2Google Cloud PlatformYour organization runs workloads in a Google Cloud VPC and requires private access to Google APIs to ensure that traffic does not traverse the public internet. Additionally, the organization has an on-premises data center that also needs private connectivity to Google APIs. Which combination of configurations should you implement to meet these requirements?
- A
Enable Private Google Access on the VPC subnet where the workloads are running.
- B
Set up Private Google Access for on-premises hosts and configure Cloud VPN or Interconnect for on-premises connectivity.
- C
Enable Private Service Connect and create a private endpoint to access Google APIs.
- D
Configure a firewall rule in the VPC to allow egress traffic to Google's public IP ranges.
- E
Enable restricted Google access to block all traffic to public Google APIs.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure private connectivity between a VPC and Google APIs, Private Google Access must be enabled on the VPC subnets. For on-premises systems, Private Google Access for on-premises hosts must be configured alongside Cloud VPN or Interconnect. These configurations allow all traffic to Google APIs to remain private and avoid traversing the public internet. Other options like Private Service Connect and restricted Google access do not meet the requirements in this scenario.
- A. Correct.
Correct: Enabling Private Google Access allows VPC workloads to privately access Google APIs without sending traffic over the public internet.
- B. Correct.
Correct: To enable private access to Google APIs from on-premises systems, you must set up Private Google Access for on-premises hosts and use Cloud VPN or Interconnect for connectivity.
- C. Incorrect.
Incorrect: Private Service Connect is used to access services offered by Google or third-party service providers over a private endpoint, but it is not required for accessing Google APIs in this scenario.
- D. Incorrect.
Incorrect: While a firewall rule allowing egress traffic to public Google IP ranges might allow access, it does not ensure private connectivity and would contradict the requirement to avoid the public internet.
- E. Incorrect.
Incorrect: Restricted Google access is used to block access to Google APIs and services that are not explicitly allowed and is unrelated to setting up private connectivity.