Google Professional Cloud Security Engineer Question 282
Single answerGoogle Cloud PlatformYour organization has several Compute Engine instances in a private subnet within a VPC. These instances need to access external APIs on the internet for sending telemetry data, but they must not have public IP addresses. How can you configure outbound internet access for these instances while maintaining network security?
- A
Assign public IP addresses to the instances and use firewall rules to restrict access.
- B
Use a Cloud NAT gateway to allow the instances to initiate outbound connections without assigning public IPs.
- C
Configure an HTTP/HTTPS Load Balancer to handle outbound traffic for the instances.
- D
Deploy a VPN gateway and establish a VPN connection to a public network.
Show answer and explanation
Correct answer: B
Explanation
To enable outbound internet access for private Compute Engine instances without assigning public IP addresses, you should use Cloud NAT. Cloud NAT (Network Address Translation) allows instances in a private subnet to initiate outbound connections to the internet securely and effectively while preserving security by not exposing the instances to the public network. This ensures compliance with security best practices in Google Cloud.
- A. Incorrect.
Assigning public IP addresses to the instances would allow them to access the internet, but it would expose the instances directly to the public network, increasing the risk of attacks. This approach does not align with the requirement to avoid public IPs.
- B. Correct.
Using a Cloud NAT gateway is the correct solution. It allows private instances to access the internet for outbound traffic while maintaining network security by not assigning public IPs to the instances.
- C. Incorrect.
An HTTP/HTTPS Load Balancer is designed for handling inbound traffic to serve web applications, not for enabling outbound connections from instances.
- D. Incorrect.
A VPN gateway is useful for connecting to on-premises networks or other private networks, but it is not a solution for enabling secure outbound internet access.