A financial enterprise is securing its Google Cloud environment to minimize perimeter attack surfaces and prevent unintended internet exposure. The security architect establishes the following requirements: Prevent all Compute Engine virtual machines (VMs) across the organization from being assigned public external IPv4 addresses by default. Allow private VMs without external IP addresses to initiate outbound connections to external public APIs and package repositories. Provide secure administrative access (SSH and RDP) to these private VMs without deploying public bastion hosts or VPN appliances. Terminate public inbound web traffic at a scalable perimeter edge before routing requests to internal backend VMs. Which combination of architectural controls and services should the security architect deploy?

Enforce the Define allowed external IPs for VM instances organization policy constraint to Deny All, deploy Cloud NAT gateways in the VPC, configure Identity-Aware Proxy (IAP) for TCP forwarding with a firewall rule permitting 35.235.240.0/20 for ports 22 and 3389, and use external Application Load Balancers with reserved external IP addresses.: ### What This Architecture Is This architecture combines preventive organizational governance, edge translation, zero-trust administrative access, and managed reverse-proxy ingress to isolate virtual machines entirely within private IP address spaces while retaining full outbound capability, secure management, and public service delivery. ### How It Meets the Requirements - **Preventing Public VM IP Assignment**: Enforcing the **Define allowed external IPs for VM instances** (`constraints/compute.vmExternalIpAccess`) organization policy constraint with a policy value of **Deny All** replaces default behaviors and blocks any Compute Engine instance in the organization from acquiring public external IP addresses. - **Outbound Connectivity for Private VMs**: **Cloud NAT** (Network Address Translation) allocates managed public IPs to translate egress traffic initiated by private RFC 1918 VMs toward external endpoints without granting those VMs direct public inbound reachability. - **Secure Bastion-less Administrative Access**: **Identity-Aware Proxy (IAP) for TCP forwarding** tunnels SSH (port 22) and RDP (port 3389) traffic directly through Google's authenticated edge infrastructure. Configuring a hierarchical or VPC firewall rule to permit ingress from the well-known Google proxy range `35.235.240.0/20` allows authenticated, authorized administrators to access VMs without assigning public IPs or running dedicated bastion hosts. - **Edge Ingress Termination**: **External Application Load Balancers** expose managed, reserved external VIPs at Google's edge (Google Front Ends) to terminate client connections, validate TLS, and distribute requests to private backend instance groups. ### Key Advantages and Capabilities - **Complete Perimeter Isolation**: Eliminates direct internet routability to compute workloads, mitigating common reconnaissance and automated network exploitation. - **Centralized Policy Enforcement**: Enforces security constraints at the organization level, preventing shadow IT and accidental external IP attachment during CI/CD deployments. - **Context-Aware Administration**: IAP enforces Google Cloud IAM roles and context-aware access policies (like device posture and identity verification) before establishing TCP tunnels. - **High Availability and Scalability**: Cloud NAT and external load balancers operate as software-defined, distributed Google services without single-point-of-failure bottlenecks. ### Why This Is Optimal This pattern aligns with defense-in-depth and zero-trust principles by ensuring that compute resources never maintain direct public IP bindings while cleanly separating inbound reverse-proxy edge routing, outbound egress translation, and IAM-gated administrative access.

Secure Perimeter Private Ip Iap Cloud Nat | Professional Cloud Security Engineer

Secure Perimeter Private Ip Iap Cloud Nat

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise is securing its Google Cloud environment to minimize perimeter attack surfaces and prevent unintended internet exposure. The security architect establishes the following requirements:

Prevent all Compute Engine virtual machines (VMs) across the organization from being assigned public external IPv4 addresses by default.
Allow private VMs without external IP addresses to initiate outbound connections to external public APIs and package repositories.
Provide secure administrative access (SSH and RDP) to these private VMs without deploying public bastion hosts or VPN appliances.
Terminate public inbound web traffic at a scalable perimeter edge before routing requests to internal backend VMs.

Which combination of architectural controls and services should the security architect deploy?

Enforce the Define allowed external IPs for VM instances organization policy constraint to Deny All, deploy Cloud NAT gateways in the VPC, configure Identity-Aware Proxy (IAP) for TCP forwarding with a firewall rule permitting 35.235.240.0/20 for ports 22 and 3389, and use external Application Load Balancers with reserved external IP addresses.

Enforce the Restrict Protocol Forwarding Based on type of IP Address constraint set to IS:EXTERNAL, deploy Internet NEGs pointing to private RFC 1918 VM addresses, and allow health check ranges 35.191.0.0/16 and 130.211.0.0/22 for SSH management.

Enforce the Skip default network creation constraint to True, configure Cloud NAT to handle both inbound and outbound traffic, permit 0.0.0.0/0 on firewall ports 22 and 3389, and use Cloud DNS routing policies for external web ingestion.

Enforce the Disable VPC External IPv6 usage constraint, create an internal Application Load Balancer with an INTERNET_IP_PORT backend, and use VPC Network Peering with Exchange subnet routes with public IP enabled for external communication.

Professional Cloud Security Engineer

Secure Perimeter Private Ip Iap Cloud Nat

Related questions