Examkin

Soru

Zorluk: OrtaDeploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules

A system administrator is deploying a custom Virtual Private Cloud (VPC) network to host internal microservices in Google Cloud. The microservices run on Compute Engine virtual machines that do not have external public IP addresses assigned. These instances must be able to reach Google Cloud Storage buckets and BigQuery API endpoints securely without exposing traffic to the public internet. Which configuration option must be enabled on the subnet to meet this requirement?

  1. Enable Private Google Access on the subnet.Cevap
  2. B
    Grant the primitive Editor role to the default Compute Engine service account.
  3. C
    Configure an egress firewall rule with priority 65535 that explicitly grants access to 0.0.0.0/0 on port 443.
  4. D
    Configure VPC Network Peering between the custom subnet CIDR block and Google APIs.

Cevap

Enable Private Google Access on the subnet to allow virtual machines with only internal IP addresses to reach Google Cloud APIs and services.
Enabling Private Google Access on a subnet allows Compute Engine VMs that have only private internal IP addresses to communicate with Google services (such as Cloud Storage and BigQuery) via Google's internal network routes.

Adım Adım Çözüm

1
Analyze the network requirements of the virtual machines
The Compute Engine VMs have internal IP addresses only and require connectivity to Google API endpoints (Cloud Storage and BigQuery).
Without public IP addresses or Cloud NAT, standard outbound internet access is disabled.
2
Evaluate Google Cloud networking features for private Google service reachability
Private Google Access is a subnet-level setting that enables instances without external IP addresses to send traffic to Google APIs.
Traffic stays within Google's network infrastructure and reaches default internal routes for Google APIs.
3
Select the correct subnet setting during or after deployment
Setting `--enable-private-ip-google-access` via gcloud CLI or toggling Private Google Access on the subnet in Cloud Console fulfills the requirement.
It directly satisfies the access requirement without requiring external IPs, Cloud NAT, or IAM broad permissions.

Anahtar Kavram

Private Google Access Subnet Configuration
Tahmini Süre:1m 15s
Bu soruyu puanla

Konular

Deploying Virtual Private Cloud (VPC) Networks, Subnets, and Firewall Rules