An enterprise organization is setting up a Shared VPC network architecture in Google Cloud to centralize network administration while enabling standalone service projects to deploy workloads. Compute Engine instances deployed in a service project subnet need to privately access Google Cloud services (such as Cloud Storage and BigQuery) without public IP addresses, and all general internet egress traffic from these instances must be routed securely through a centralized NAT solution. Which TWO network configuration steps must be performed in the Host Project to meet these requirements? (Select TWO.)
- Enable Private Google Access on the subnets within the Shared VPC host project where the service project workloads are attached.Answer
- BEstablish a VPC Network Peering connection between the Service Project VPC and the Host Project VPC to enable internal routing to Cloud NAT.
- Configure Cloud NAT on a Cloud Router created in the Shared VPC host project for the region hosting the service workloads.Answer
- DDeploy Cloud Interconnect between the Service Project and Host Project to route internal traffic to Google API endpoints.
- EConfigure control plane authorized networks on the host VPC firewall to grant external access to Google API endpoints.
Answer
The correct configuration steps are enabling Private Google Access on the subnets in the Shared VPC host project and configuring Cloud NAT on a Cloud Router in the host project for the relevant region.
In a Shared VPC topology, network resources such as subnets, Cloud Routers, and Cloud NAT gateways are provisioned and managed centrally in the Host Project. Enabling Private Google Access on the host project's subnets grants internal-only VMs in attached service projects access to Google APIs. Creating a Cloud Router with Cloud NAT in the host project provides controlled, managed outbound internet egress for workloads in those shared subnets.
Step-by-Step Solution
Key Concept
Shared VPC Centralized Network Provisioning with Private Google Access and Cloud NAT