Examkin

Question

Difficulty: MediumDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A cloud solution architect is deploying a custom-mode Virtual Private Cloud (VPC) subnet to host internal Compute Engine virtual machines that do not have public IP addresses assigned. These virtual machines must be able to upload log files directly to a Google Cloud Storage bucket without sending traffic over the public internet or utilizing NAT gateways.

Which configuration must be enabled on the subnet to support this connectivity requirement?

  1. Enable Private Google Access on the target VPC subnet.Answer
  2. B
    Assign the primitive Owner role to the instance service account to bypass internet route checks.
  3. C
    Create an egress firewall rule with priority 65535 targeting the Google Cloud Storage API IP ranges.
  4. D
    Switch the VPC network mode from custom-mode to auto-mode to auto-create internal API routes.

Answer

Enable Private Google Access on the target VPC subnet.
Enabling Private Google Access on the subnet permits Compute Engine VM instances with only internal IP addresses to reach the external IP addresses of Google APIs and services such as Google Cloud Storage.

Step-by-Step Solution

1
Identify the network requirements for instances lacking public IP addresses.
Instances only have internal IP addresses and cannot send packets directly over default internet gateways to public endpoints.
Google API endpoints like Cloud Storage resolve to public IP space, which standard internal VM instances without public IPs cannot reach without special networking features.
2
Determine the Google Cloud network feature designed for private Google API access.
Private Google Access enables internal IP instances in a subnet to communicate with Google services.
Enabling Private Google Access on a subnet allows traffic destined for Google APIs to be routed internally over Google's internal network backbone.
3
Configure the setting at the subnet level.
Subnet setting `privateIpGoogleAccess` is set to enabled.
Private Google Access is enabled per-subnet in GCP custom or auto VPC networks.

Key Concept

Private Google Access on VPC Subnets
Estimated Time:1m 15s
Rate this question

Topics

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules