Google Professional Cloud Security Engineer Question 284
Single answerGoogle Cloud PlatformYou are designing a Google Cloud solution for a virtual private cloud (VPC) network that hosts private instances without external IP addresses. These instances need to access external services on the internet, such as API endpoints, while maintaining strict control over inbound traffic. Which Google Cloud service configuration should you use to achieve this?
- A
Assign external IP addresses to the instances and use a firewall rule to block inbound traffic.
- B
Configure a Cloud NAT gateway for the VPC network to allow outbound traffic while keeping instances private.
- C
Use a proxy server deployed in the VPC network to route outbound traffic from the private instances.
- D
Enable Private Google Access and use it to route all outbound traffic through Google's private network.
Show answer and explanation
Correct answer: B
Explanation
Cloud NAT (Network Address Translation) is the appropriate solution for enabling private instances in a VPC to make outbound internet connections while preventing inbound traffic. It allows instances without external IP addresses to access external services securely, meeting the requirements of the scenario. Other options either expose the instances unnecessarily, increase complexity, or do not cover all use cases for outbound traffic.
- A. Incorrect.
Assigning external IP addresses allows outbound traffic but exposes the instances to potential inbound traffic, even with a firewall rule in place. This does not meet the requirement to keep instances private.
- B. Correct.
Cloud NAT is specifically designed to enable private instances to make outbound connections to the internet without needing external IP addresses. This meets the requirements outlined in the scenario.
- C. Incorrect.
Using a proxy server could work but requires additional maintenance and configuration, increasing complexity unnecessarily when Cloud NAT provides a simpler and more secure solution.
- D. Incorrect.
Private Google Access is used for accessing Google APIs and services from private instances but does not support general outbound internet traffic. It is not sufficient for this use case.