Google Professional Cloud Security Engineer Question 279
Select 2Google Cloud PlatformYour organization has a hybrid cloud architecture with on-premises workloads that need secure access to Google Cloud APIs and services, such as BigQuery and Cloud Storage, without exposing traffic to the public internet. Which solution(s) should you implement to establish private connectivity between your on-premises environment and Google APIs?
- A
Enable Private Google Access for on-premises hosts and ensure a Cloud VPN or Interconnect is in place.
- B
Configure a VPC Service Controls perimeter to restrict access to Google APIs and services.
- C
Set up Private Service Connect endpoints to map Google APIs to private IP addresses within your VPC.
- D
Enable Private Google Access in the VPC and use NAT to route traffic from on-premises through the VPC.
- E
Use a public IP address and set up firewall rules to restrict access to Google APIs from specific IP ranges.
Show answer and explanation
Correct answers: A, C
Explanation
To establish private connectivity between an on-premises environment and Google APIs, you must use either Private Google Access for on-premises hosts or Private Service Connect. Private Google Access for on-premises hosts enables secure communication over a private connection, such as Cloud VPN or Interconnect, while Private Service Connect allows you to map Google APIs to private IPs within your VPC. Both solutions prevent traffic from traversing the public internet, ensuring compliance with security and privacy requirements.
- A. Correct.
Correct: Private Google Access for on-premises hosts allows on-premises systems to securely access Google APIs and services over a private connection (such as Cloud VPN or Dedicated Interconnect). This ensures traffic does not traverse the public internet.
- B. Incorrect.
Incorrect: VPC Service Controls enhance security by creating service perimeters, but they do not directly establish private connectivity for on-premises environments to access Google APIs.
- C. Correct.
Correct: Private Service Connect allows you to create private endpoints within your VPC for Google APIs, effectively enabling private connectivity between your on-premises and Google APIs through your VPC.
- D. Incorrect.
Incorrect: While enabling Private Google Access in the VPC allows private instances in the VPC to access Google APIs, it does not enable direct private connectivity from on-premises unless combined with Private Google Access for on-premises.
- E. Incorrect.
Incorrect: Using public IP addresses and firewall rules exposes traffic to the public internet, which violates the requirement for private connectivity.