Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
An enterprise is deploying an AI agent runtime on Google Cloud that must securely query third-party external tool APIs across the internet. The agent workloads are hosted in a private VPC subnet without external IP addresses.
To control and monitor outbound connections, all agent traffic to external APIs is routed through an Internal Application Load Balancer with internet Network Endpoint Groups (internet NEGs). The external API providers require all incoming API requests to originate from a known, dedicated set of allowlisted public IP addresses.
Which network architecture configuration should the security engineer implement to satisfy these requirements?
Cloud NAT for managed proxy load balancers allows regional internal proxy-based load balancers (such as regional Internal Application Load Balancers) that route traffic to external backends via internet NEGs to translate proxy egress traffic through specific public NAT IP addresses.
StudyCerts
StudyCerts--endpoint-types=ENDPOINT_TYPE_MANAGED_PROXY_LB ensures the NAT gateway specifically handles egress traffic originating from the Envoy proxies residing in the load balancer's proxy-only subnet.--nat-custom-subnet-ip-ranges=PROXY_ONLY_SUBNET_NAME provides NAT service strictly for the subnet that hosts the load balancer proxy interfaces rather than general VM subnets.When using an Internal Application Load Balancer with internet NEGs, the backend TCP/HTTP connections to external endpoints originate from Envoy proxies inside the proxy-only subnet, not directly from the agent VMs. Standard VM-based Cloud NAT cannot translate proxy-only subnet traffic. Configuring Cloud NAT with ENDPOINT_TYPE_MANAGED_PROXY_LB and manual static IP allocation directly meets the architectural and allowlisting constraints.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.