Configure Private Google Access Vpc Service Controls

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is deploying Compute Engine virtual machines without external IP addresses in a custom subnet (10.10.1.0/24). The workloads need to securely communicate with Cloud Storage and Artifact Registry while preventing data exfiltration to non-supported external services by leveraging an active VPC Service Controls security perimeter.

The VPC network enforces a strict baseline egress policy with an explicit low-priority deny rule for 0.0.0.0/0.

Which set of actions should the security engineer take to establish connectivity while maintaining network isolation and security perimeter enforcement?

Enable Private Google Access on the subnet, configure Cloud DNS to resolve *.googleapis.com and *.pkg.dev to private.googleapis.com (199.36.153.8/30), ensure a route exists for 199.36.153.8/30 to the default internet gateway, and create an egress allow firewall rule for 199.36.153.8/30 on TCP port 443.

Enable Private Google Access on the subnet, configure Cloud DNS to resolve *.googleapis.com and *.pkg.dev to restricted.googleapis.com (199.36.153.4/30), ensure a default route exists to the default internet gateway for 199.36.153.4/30, and create an egress allow firewall rule for 199.36.153.4/30 on TCP port 443.

Deploy a Cloud NAT gateway in the VPC network region, assign it to the subnet, and configure an egress allow firewall rule targeting destination 0.0.0.0/0 on TCP port 443.

Configure Private services access by establishing VPC Network Peering with Google's service producer network, and add an ingress allow firewall rule for the peered subnet range.

Professional Cloud Security Engineer

Configure Private Google Access Vpc Service Controls

Related questions