Google Professional Cloud Security Engineer Question 281
Single answerGoogle Cloud PlatformYour organization has a hybrid cloud setup with an on-premises data center connected to Google Cloud via a VPN. Your team needs to enable secure private connectivity from on-premises hosts to Google APIs and services (e.g., Cloud Storage and BigQuery) without routing traffic over the public internet. Which solution should you implement?
- A
Enable Private Google Access for on-premises hosts and configure the necessary DNS routes.
- B
Set up a Cloud NAT gateway in the VPC and enable Private Google Access for subnetworks.
- C
Use Private Service Connect to connect directly to Google APIs and services.
- D
Configure a custom static route from on-premises to Google APIs using an external IP range.
Show answer and explanation
Correct answer: A
Explanation
To enable secure private connectivity to Google APIs and services from on-premises hosts, you must configure Private Google Access for on-premises hosts. This ensures that traffic flows over the private connection (VPN or Interconnect) without using the public internet. Additionally, DNS configuration is required to resolve Google API endpoints to private IP addresses. Other options, such as Cloud NAT and Private Service Connect, do not address the specific requirement for on-premises connectivity to Google APIs.
- A. Correct.
This is the correct solution. Private Google Access for on-premises hosts allows on-premises systems to securely access Google APIs and services over a private connection such as a VPN or Interconnect. DNS routing must also be configured to direct traffic properly.
- B. Incorrect.
This is incorrect because Cloud NAT with Private Google Access only applies to instances within a Google Cloud VPC, not on-premises hosts.
- C. Incorrect.
Private Service Connect is used for connecting to managed services in private mode but is not designed for directly accessing Google APIs and services from on-premises hosts.
- D. Incorrect.
This is incorrect because static routes to external IP ranges do not provide private connectivity and will route traffic over the public internet.