Google Professional Cloud Security Engineer Question 285
Select 3Google Cloud PlatformYour organization has deployed several private virtual machine (VM) instances in a Google Cloud VPC. These instances do not have external IP addresses but need to access external APIs on the internet for processing. To achieve this, you decide to implement Cloud NAT. Which of the following statements are true about configuring and using Cloud NAT in this scenario?
- A
Cloud NAT enables the private VM instances to send outbound traffic to the internet without requiring external IP addresses.
- B
You need to configure a Cloud Router to set up and manage Cloud NAT in your network.
- C
Cloud NAT automatically allows incoming connections from the internet to the private VM instances.
- D
Cloud NAT supports fine-grained controls to restrict egress traffic by destination IP ranges and ports.
- E
Private VM instances must have a public IP address assigned to communicate via Cloud NAT.
Show answer and explanation
Correct answers: A, B, D
Explanation
Cloud NAT is a managed network address translation service that allows private VM instances to access external resources on the internet without exposing them directly via external IPs. It is configured through a Cloud Router and supports advanced features like controlling egress traffic by destination range or port. However, Cloud NAT does not support incoming traffic, and it is specifically designed for instances without external IP addresses.
- A. Correct.
Correct: One of the primary purposes of Cloud NAT is to allow private VM instances (without external IPs) to initiate outbound connections to external resources on the internet.
- B. Correct.
Correct: Cloud NAT is managed through a Cloud Router, which handles the NAT configuration and routing in the network.
- C. Incorrect.
Incorrect: Cloud NAT only supports outbound (egress) connections. It does not allow incoming (ingress) connections from the internet to the private VM instances.
- D. Correct.
Correct: Cloud NAT provides options to control which destination IP ranges and ports are accessible, enabling secure and fine-grained outbound traffic management.
- E. Incorrect.
Incorrect: Cloud NAT is specifically designed for private VM instances without external IPs. Assigning a public IP to the VM would negate the need for Cloud NAT.