An enterprise maintains hybrid workloads in an on-premises data center connected to a Google Cloud Virtual Private Cloud (VPC) via Dedicated Interconnect. The organization enforces a VPC Service Controls (VPC-SC) perimeter around its cloud projects to prevent data exfiltration. The security team mandates that on-premises servers must access Google APIs privately through the Interconnect link without traversing the public internet, and all API traffic must be strictly governed by the VPC Service Controls perimeter. Which combination of routing and DNS configurations should you implement to satisfy these security requirements?

Advertise the 199.36.153.4/30 CIDR range via custom BGP route advertisements on Cloud Router, create a Cloud DNS inbound server policy, and configure DNS response policies or private zones to map *.googleapis.com to restricted.googleapis.com.: ### What Private Google Access for On-Premises Hosts Is **Private Google Access for on-premises hosts** allows systems outside Google Cloud (such as servers in an on-premises data center) to reach Google APIs and services privately over **Cloud Interconnect** or **Cloud VPN** using private or restricted Virtual IP (VIP) addresses. ### How It Meets the Requirements - **Route Advertisement:** The `restricted.googleapis.com` domain resolves to the `199.36.153.4/30` CIDR block (`199.36.153.4`, `199.36.153.5`, `199.36.153.6`, and `199.36.153.7`). By configuring **custom BGP route advertisements** on **Cloud Router**, the `199.36.153.4/30` prefix is announced to on-premises edge routers, establishing a private network path over Cloud Interconnect. - **VPC Service Controls Enforcement:** Routing traffic to `restricted.googleapis.com` ensures that only APIs supported by **VPC Service Controls** are accessible, completely blocking access to unsupported Google services and preventing perimeter data exfiltration. - **Cloud DNS Inbound Resolution:** Creating an **inbound server policy** in Cloud DNS allocates internal IP addresses within the VPC subnets. On-premises DNS resolvers forward `googleapis.com` queries to these inbound entry points, where a private DNS zone or **DNS Response Policy** aliases `*.googleapis.com` to `restricted.googleapis.com`. ### Key Capabilities - **No Public Egress Required:** Hybrid workloads communicate directly with Google APIs without needing public IPv4 addresses, NAT gateways, or internet gateways. - **Strict Perimeter Isolation:** Ensures compliance with security boundaries by restricting connectivity to services that respect perimeter borders. - **Centralized Hybrid DNS:** Uses standard DNS forwarding patterns to simplify cross-premises name resolution without modifying client application code. ### Why This Is Optimal This architecture establishes end-to-end private connectivity while adhering to the principle of least privilege at the network boundary, ensuring that hybrid traffic cannot bypass VPC Service Controls perimeter policies.

Pga On Premises Vpc Service Controls | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise uses a hub-and-spoke network topology on Google Cloud. The central hub-vpc is connected to multiple departmental spoke VPCs via VPC Network Peering, with custom route exchange enabled to share internal routes across networks. A security engineer is deploying a private VPC-native Google Kubernetes Engine (GKE) cluster in spoke-vpc-a. The cluster deployment fails during creation with an IP address conflict error, even though the selected /28 control plane IP range does not overlap with any primary or secondary subnet ranges locally configured inside spoke-vpc-a. What is the root cause of this deployment failure, and how should the engineer resolve it?

Designing and configuring private connectivity between VPC networks and Google Cloud projects (Shared VPC, VPC peering, and Private Google Access for on-premises hosts).

AdvancedProfessional Cloud Security Engineer

An enterprise security architect is designing a multi-project network topology in Google Cloud using Shared VPC. The organization requires strict separation of duties, resource isolation, and centralized network governance between the central cloud infrastructure team and individual application development teams. The design must meet the following requirements: Central infrastructure administrators must retain exclusive control over VPC networks, IP address allocations, routes, and firewall rules within the host project. Application teams managing service-project-a must only be able to deploy Compute Engine virtual machines and internal load balancers into an assigned subnet (subnet-app-prod) in us-central1. Application developers must be prevented from provisioning workloads into any other subnets (such as subnet-management or subnet-app-dev) and must not have permissions to modify host network security policies. Which IAM role delegation strategy should the architect implement?

AdvancedProfessional Cloud Security Engineer

An enterprise financial application running on Google Cloud Compute Engine requires access to database credentials stored in Secret Manager. The security team establishes strict security requirements: The application service account must only be granted permission to retrieve the decrypted secret payload for its specific database secret, without administrative permissions over other secrets. Exfiltration of secret payloads to unauthorized projects or outside the trusted enterprise network perimeter must be strictly prevented. Access to the Secret Manager API must be contained within a defined security boundary that blocks public internet calls. Which combination of access governance and network security controls should you implement to satisfy these requirements?

AdvancedProfessional Cloud Security Engineer

An enterprise security architect is designing an encryption and governance model for Google Cloud services across multiple application projects. The security compliance mandate states: All newly provisioned workloads must strictly use Customer-Managed Encryption Keys (CMEK) rather than Google default encryption. Encryption keys must be centrally managed in a dedicated security project (prj-kms-central) to enforce separation of duties. Service agents must adhere to the principle of least privilege when accessing cryptographic resources. Which combination of Organization Policy constraints and IAM configurations should the architect implement?

AdvancedProfessional Cloud Security Engineer

A security engineer needs to configure a conditional IAM role binding for an external operations team in Google Cloud. The team requires administrative access to compute resources only during standard working business hours in Germany. The access must satisfy the following criteria: Access is permitted strictly from Monday through Friday. Access is permitted starting at 09:00:00 Central European Time (Europe/Berlin). Access must automatically terminate at 16:59:59 Central European Time (Europe/Berlin) so that no access is granted once the clock strikes 17:00:00. Which Common Expression Language (CEL) condition expression should the engineer bind to the IAM policy?

AdvancedProfessional Cloud DevOps Engineer

Your microservices application running on Google Kubernetes Engine (GKE) is experiencing high p99 latency spikes during peak hours. The application communicates internally with a Cloud SQL database and externally with a third-party payment gateway via an Internal Application Load Balancer and Cloud NAT. You need to distinguish whether the root cause of the latency bottleneck is caused by internal application processing, internal network round-trip time (RTT), or external service dependencies. Which observability strategy should you implement?

Professional Cloud Security Engineer

Pga On Premises Vpc Service Controls

Related questions