Examkin

Question

Difficulty: MediumConfiguring Network Topology and VPC Infrastructure

An organization is configuring a Virtual Private Cloud (VPC) network topology for internal compute resources. Compute Engine instances reside in a private subnet with no external IP addresses assigned. These instances require outbound access to download software updates from external internet repositories and must also interact with Google Cloud Storage APIs, while preventing any inbound internet traffic. Which configuration properly enables these requirements with minimal operational complexity?

  1. Enable Private Google Access on the private subnet for Google Cloud API traffic, and configure Cloud Router with Cloud NAT for outbound internet egress.Answer
  2. B
    Establish VPC Network Peering to a central transit VPC containing a Cloud NAT gateway, allowing instances in the private subnet to route internet traffic transitively through the peered network.
  3. C
    Provision a 10 Gbps Dedicated Interconnect connection to route all outbound internet traffic and Cloud Storage API calls through on-premises network firewalls.
  4. D
    Assign granular Identity and Access Management (IAM) roles to the service account without modifying subnet settings, allowing API and internet traffic through Google default routing.

Answer

Enabling Private Google Access on the subnet alongside Cloud Router with Cloud NAT provides direct access to Google Cloud APIs and outbound internet connectivity for private instances without exposing them to inbound connections.
Enabling Private Google Access on a VPC subnet allows virtual machines without public IP addresses to securely reach Google Cloud APIs such as Cloud Storage via internal IP routing. Deploying Cloud NAT using Cloud Router enables controlled outbound internet access for software updates while preventing inbound internet connections from reaching the instances.

Step-by-Step Solution

1
Identify network connectivity requirements for virtual machines without external IP addresses.
Instances require access to both Google Cloud APIs (Cloud Storage) and public internet destinations (repository updates).
Without external IP addresses or NAT mechanisms, instances cannot initiate outbound TCP/UDP traffic to public destinations.
2
Select the appropriate native GCP VPC networking features.
Private Google Access routes traffic to Google APIs over internal Google networking routes. Cloud NAT provides managed Network Address Translation for public internet egress.
This combination keeps instances isolated from inbound internet access while satisfying both outbound connectivity needs efficiently.

Key Concept

Subnet Private Google Access and Cloud NAT configuration for private VPC egress.
Rate this question

Topics

Configuring Network Topology and VPC Infrastructure

More questions from this topic