Examkin

Question

Difficulty: Very hardManaging Cloud Run Resources

An enterprise operations team is managing a mission-critical containerized microservice named `payment-service` deployed on Cloud Run. Security policy mandates two strict operational requirements:
1. The service must block direct public internet access and only accept inbound requests routed through an internal Application Load Balancer or internal VPC resources.
2. All outbound requests made by container instances to external third-party payment gateways must egress through a static, reserved IP address using a Cloud NAT instance attached to the company's Virtual Private Cloud (VPC).

Which TWO configuration settings or `gcloud run services update` command flags must be configured on the Cloud Run resource to meet these security requirements? (Select TWO.)

  1. Configure `--ingress=internal-and-cloud-load-balancing` on the Cloud Run service.Answer
  2. Configure `--vpc-egress=all-traffic` alongside a VPC connector or Direct VPC egress.Answer
  3. C
    Configure `--ingress=internal` and grant the primitive `roles/viewer` role to `allUsers` on the Cloud Run service.
  4. D
    Configure `--vpc-egress=private-ranges-only` to ensure outbound internet calls bypass VPC routing and execute faster.

Answer

To meet the security requirements, you must restrict inbound traffic using `--ingress=internal-and-cloud-load-balancing` and force all outbound container traffic through the VPC using `--vpc-egress=all-traffic`.
The requirement to block direct internet traffic while accepting load-balanced traffic is satisfied by configuring `--ingress=internal-and-cloud-load-balancing`. The requirement to send outbound external requests through a Cloud NAT static IP is satisfied by attaching a VPC network interface (VPC Access Connector or Direct VPC egress) and specifying `--vpc-egress=all-traffic`.

Step-by-Step Solution

1
Analyze Ingress Requirements
To block direct public access while allowing traffic from an internal/external Cloud Load Balancer and internal VPC endpoints, Cloud Run ingress must be set to `internal-and-cloud-load-balancing`.
The default setting `all` allows direct traffic to the service's default URL, whereas `internal` blocks Cloud Load Balancing unless specifically routed internally.
2
Analyze Outbound Egress & Cloud NAT Requirements
To route outbound calls destined for external third-party payment gateways through a static IP address via Cloud NAT, all egress traffic must pass through a VPC network connector.
By default, Cloud Run egress routes public IP traffic directly out to the internet via shared GCP IP pools. Setting `--vpc-egress=all-traffic` overrides this behavior so that outbound internet calls pass through the designated VPC subnet and hit the Cloud NAT gateway.

Key Concept

Cloud Run Networking Controls: Ingress Policies and VPC Egress Routing
Rate this question

Topics

Managing Cloud Run Resources

More questions from this topic