Google Professional Cloud Security Engineer Question 280
Select 3Google Cloud PlatformYour organization has a hybrid cloud setup with on-premises workloads that need to securely access Google APIs and services without traversing the public internet. As a Professional Cloud Security Engineer, you are tasked with designing a solution that ensures private connectivity from your on-premises environment to Google APIs. Which steps should you take to achieve this?
- A
Enable Private Google Access for on-premises hosts.
- B
Create a Private Service Connect endpoint in your on-premises environment.
- C
Set up a Cloud VPN or Dedicated Interconnect to establish connectivity between your on-premises network and the VPC hosting the Google APIs.
- D
Configure DNS to resolve *.googleapis.com to restricted VIPs.
- E
Enable Private Google Access in the VPC where the Cloud VPN or Interconnect terminates.
Show answer and explanation
Correct answers: A, C, D
Explanation
To establish private connectivity between on-premises hosts and Google APIs, you need to enable Private Google Access for on-premises hosts, set up private connectivity (via Cloud VPN or Dedicated Interconnect), and ensure DNS resolves Google API endpoints to restricted VIPs. These steps ensure secure, private communication without using the public internet, meeting the organization's security and compliance requirements.
- A. Correct.
Correct. Enabling Private Google Access for on-premises hosts allows on-premises systems to use private IP addresses to access Google APIs over a private connection.
- B. Incorrect.
Incorrect. Private Service Connect is used to privately connect to Google services or third-party SaaS providers, but it is not required for accessing Google APIs from on-premises hosts.
- C. Correct.
Correct. A Cloud VPN or Dedicated Interconnect is necessary to establish private connectivity between your on-premises environment and the Google Cloud VPC, where Private Google Access can be utilized.
- D. Correct.
Correct. Configuring DNS to resolve *.googleapis.com to restricted VIPs ensures that traffic destined for Google APIs is routed through private connectivity rather than the public internet.
- E. Incorrect.
Incorrect. Enabling Private Google Access in the VPC is required only for workloads running within that VPC to access Google APIs, not for on-premises hosts.