Google Professional Cloud Security Engineer Question 286
Single answerGoogle Cloud PlatformYou are tasked with configuring outbound internet access for a private VM instance in a Google Cloud environment. The VM instance does not have an external IP address, but it needs to connect to an external API service. Which configuration step is required to enable this instance to send traffic to the internet while remaining secure?
- A
Assign a global external IP address to the VM instance.
- B
Configure a Cloud NAT gateway and associate it with the VM's subnet.
- C
Enable Private Google Access on the VM's subnet.
- D
Use a firewall rule to allow outbound traffic to the internet.
Show answer and explanation
Correct answer: B
Explanation
Cloud NAT (Network Address Translation) provides a secure and scalable way for private instances to send outbound traffic to the internet without requiring external IP addresses. By configuring a Cloud NAT gateway and associating it with the VM's subnet, you enable the VM to connect to external APIs securely without exposing it directly to the internet.
- A. Incorrect.
Assigning a global external IP address to the VM instance would expose it directly to the internet, which is not recommended for private instances requiring secure outbound traffic. This does not solve the problem of securely accessing the internet without an external IP.
- B. Correct.
Configuring a Cloud NAT gateway and associating it with the VM's subnet allows private instances without external IPs to securely access the internet for outbound traffic. This is the correct approach for the given scenario.
- C. Incorrect.
Enabling Private Google Access allows private VMs to access Google APIs and services without external IPs, but it does not enable access to external APIs or the general internet.
- D. Incorrect.
A firewall rule can control traffic to and from the VM, but by itself, it does not enable outbound internet access for a private VM without an external IP address.