Cloud Nat Managed Proxy External Backend

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is deploying an AI agent runtime on Google Cloud that must securely query third-party external tool APIs across the internet. The agent workloads are hosted in a private VPC subnet without external IP addresses.

To control and monitor outbound connections, all agent traffic to external APIs is routed through an Internal Application Load Balancer with internet Network Endpoint Groups (internet NEGs). The external API providers require all incoming API requests to originate from a known, dedicated set of allowlisted public IP addresses.

Which network architecture configuration should the security engineer implement to satisfy these requirements?

Deploy a global Network Firewall Policy with an egress NAT rule linked to the proxy-only subnet using IAM-governed resource tags.

Configure Cloud Armor security policies with egress filtering rules attached to the internal load balancer and assign Cloud NAT with dynamic IP allocation to the agent subnet.

Configure a Cloud NAT gateway with the endpoint type set to managed proxy load balancers, apply it to the proxy-only subnet, and assign manually allocated static IP addresses.

Configure a Cloud NAT gateway with the endpoint type set to Compute Engine instances, target the agent workload subnet, and select automatic IP allocation.

Professional Cloud Security Engineer

Cloud Nat Managed Proxy External Backend

Related questions