Google Professional Cloud Security Engineer Question 287
Single answerGoogle Cloud PlatformYour company is hosting a private application on Google Cloud that does not require public IP addresses for its Compute Engine instances. However, the application needs to make outbound API requests to external services on the internet. How can you configure this setup to meet the requirements while ensuring secure and cost-efficient access?
- A
Assign public IP addresses to the Compute Engine instances and configure firewall rules to allow outbound traffic.
- B
Use a Cloud NAT gateway to enable the Compute Engine instances to access the internet without assigning public IP addresses.
- C
Enable Private Google Access on the VPC network and configure DNS policies for outbound traffic.
- D
Deploy a proxy server in the VPC network and route all outbound traffic through the proxy.
Show answer and explanation
Correct answer: B
Explanation
The best solution to meet the requirements is to use a Cloud NAT gateway. It enables secure and cost-efficient outbound internet access for Compute Engine instances without public IP addresses. This approach ensures that instances remain private while still being able to access external services, aligning with both security and cost considerations.
- A. Incorrect.
Assigning public IP addresses would allow outbound traffic, but it violates the requirement to avoid public IPs and increases security risks and costs.
- B. Correct.
Using a Cloud NAT gateway allows Compute Engine instances to send outbound traffic to the internet securely and cost-efficiently without requiring public IP addresses, meeting the requirements.
- C. Incorrect.
While enabling Private Google Access allows access to Google APIs and services, it does not enable general outbound internet traffic, which is needed in this scenario.
- D. Incorrect.
Deploying a proxy server could achieve outbound traffic, but it introduces additional complexity, management overhead, and is less efficient than using a Cloud NAT gateway.