An enterprise is deploying a fleet of private Compute Engine instances without external IP addresses into a dedicated Virtual Private Cloud (VPC) subnet. The security team has defined the following security, routing, and observability requirements: The instances must reach external repositories on the public internet to download software updates. All traffic directed to Google APIs (such as Cloud Storage and BigQuery) must stay on Google's internal network and bypass internet NAT translation. Egress firewall policies must evaluate and restrict outbound traffic based on the internal IP addresses of the instances before translation. The security team must capture log records for all successful outbound NAT connections as well as dropped packets due to NAT port exhaustion, and receive alerts if VMs fail to allocate NAT source ports. Which combination of architectural configurations and observability controls should the security engineer implement?

Enable Private Google Access on the subnet, deploy a regional Cloud NAT gateway configured for the subnet, define egress Cloud NGFW rules targeting the VM internal IP addresses, enable Cloud NAT logging with 'Translation and errors' selected, and configure a Cloud Monitoring alert policy on the 'nat_allocation_failed' metric.: ### What the solution is This architecture combines **Private Google Access (PGA)**, **Cloud NAT**, **Cloud Next Generation Firewall (Cloud NGFW)** policies, **Cloud NAT logging**, and **Cloud Monitoring** alerting to deliver secure outbound internet connectivity, optimize Google API routing, enforce pre-translation firewall filtering, and provide robust telemetry. ### How it meets the requirements - **Software updates via internet**: The **Cloud NAT gateway** provides managed, software-defined source network address translation (**SNAT**) for VMs without external IP addresses. - **Private Google API traffic**: Enabling **Private Google Access** on the subnet ensures that traffic sent to default Google APIs and services routes directly across Google's internal network without traversing the public internet or consuming Cloud NAT gateway ports. - **Egress firewall enforcement**: Google Cloud evaluates egress **firewall rules** directly on the VM's network interface *before* **Cloud NAT** applies source address translation. This allows security policies to inspect and filter connections using the VM's internal IP addresses. - **Connection logging and alerting**: Setting Cloud NAT logging to **Translation and errors** (`ALL`) captures both established outbound connections and dropped packets caused by port exhaustion in **Cloud Logging**. Creating an alerting policy on the `nat_allocation_failed` metric in **Cloud Monitoring** ensures real-time notification when workloads run out of available NAT ports. ### Key advantages and capabilities - **Optimized NAT capacity**: Diverting Google API traffic through **Private Google Access** prevents premature NAT port exhaustion. - **Distributed data plane**: **Cloud NAT** is implemented directly in Andromeda software-defined networking without introducing single-instance virtual appliance bottlenecks. - **Comprehensive security auditing**: Captures complete connection metadata (source internal IP, destination IP, assigned NAT port) for compliance and incident response. - **Proactive capacity management**: Alerts operators before port exhaustion causes widespread packet drops and application failures. ### Why this is optimal This approach leverages fully managed, cloud-native services that scale horizontally while maintaining strict least-privilege boundary controls and full observability across all outbound network flows.

Cloud Nat Pga Firewall Observability Integration | Professional Cloud Security Engineer

Cloud Nat Pga Firewall Observability Integration

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is deploying a fleet of private Compute Engine instances without external IP addresses into a dedicated Virtual Private Cloud (VPC) subnet. The security team has defined the following security, routing, and observability requirements:

The instances must reach external repositories on the public internet to download software updates.
All traffic directed to Google APIs (such as Cloud Storage and BigQuery) must stay on Google's internal network and bypass internet NAT translation.
Egress firewall policies must evaluate and restrict outbound traffic based on the internal IP addresses of the instances before translation.
The security team must capture log records for all successful outbound NAT connections as well as dropped packets due to NAT port exhaustion, and receive alerts if VMs fail to allocate NAT source ports.

Which combination of architectural configurations and observability controls should the security engineer implement?

Deploy Cloud NAT with static manual IP addresses, delete the default internet gateway route, enable VPC Flow Logs with 15-minute aggregation intervals, write ingress firewall rules permitting NAT responses, and configure Pub/Sub alerts via Cloud Asset Inventory notifications.

Configure a VPC Service Controls perimeter bridge to route internet traffic, create a Cloud NAT gateway logging 'Translations only', define hierarchical firewall rules using destination FQDNs, and create a Cloud Logging export sink to Pub/Sub to trigger a Cloud Run function for alert generation.

Configure Private Services Access with a peering range, deploy Cloud NAT with automatic IP allocation, write egress firewall rules matching the Cloud NAT external IP addresses, enable Cloud NAT logging for 'Errors only', and create a Cloud Monitoring alert on the 'nat_ports_used' metric.

Enable Private Google Access on the subnet, deploy a regional Cloud NAT gateway configured for the subnet, define egress Cloud NGFW rules targeting the VM internal IP addresses, enable Cloud NAT logging with 'Translation and errors' selected, and configure a Cloud Monitoring alert policy on the 'nat_allocation_failed' metric.

Professional Cloud Security Engineer

Cloud Nat Pga Firewall Observability Integration

Related questions