An enterprise is deploying internal workloads across multiple subnets in a Google Cloud VPC without public IP addresses. The organization must meet the following egress security and partner integration requirements: Workloads in the payment subnet (10.10.1.0/24) must route outbound traffic to external payment gateways using a dedicated, reserved static external IP address (IP_ADDRESS_1) for IP whitelisting. Workloads in the analytics subnet (10.10.2.0/24) must route outbound traffic to an external reporting endpoint using a separate reserved static external IP address (IP_ADDRESS_2). All other private subnets in the VPC must route general outbound internet traffic through a default pool of static external IP addresses. Which Cloud NAT configuration should the cloud security engineer implement?

Configure a Cloud NAT gateway with manual IP allocation, specify a default external IP pool, and define Cloud NAT rules using CEL expressions with `inIpRange(source.ip, ...)` to assign dedicated `--source-nat-active-ips` per subnet.: What Cloud NAT Rules with Manual IP Allocation Are Cloud NAT rules allow fine-grained control over how network address translation maps internal traffic to specific external IP addresses based on matching criteria, such as source or destination IP ranges. Using manual IP allocation, administrators pre-allocate regional static external IP addresses and bind them deterministically to the gateway and specific NAT rules. How it meets the requirements Dedicated payment IP (10.10.1.0/24): A NAT rule configured with a Common Expression Language (CEL) match condition (inIpRange(source.ip, '10.10.1.0/24')) maps outbound packets from this subnet to --source-nat-active-ips=IP_ADDRESS_1. Dedicated analytics IP (10.10.2.0/24): A second NAT rule with higher/lower priority matching inIpRange(source.ip, '10.10.2.0/24') maps outbound packets from the analytics subnet to --source-nat-active-ips=IP_ADDRESS_2. Default fallback pool: Packets from other subnets that do not match the specific source rules automatically fall back to the default NAT rule and consume external IPs from the gateway's primary --nat-external-ip-pool. Zero-trust and defense-in-depth: VMs remain private with no direct external IPs, preventing unsolicited ingress while providing deterministic egress attribution for external whitelisting. Key advantages Granular IP attribution: Enables distinct external IP whitelisting per subnet or workload type on a single gateway. Dynamic CEL rule matching: Supports flexible source and destination filtering expressions. Operational efficiency: Eliminates the need to deploy redundant gateways or multiple routing topologies across the VPC. High availability and scale: Leverages Google Cloud's distributed software-defined NAT architecture without bottlenecking through intermediate proxy VMs. Why this is optimal This configuration adheres to least privilege and defense-in-depth principles by maintaining private VM network interfaces while fulfilling partner firewall whitelisting constraints using a centralized, software-defined Cloud NAT gateway.

StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Nat Source Based Rules Static Ip

Section: Using Cloud NAT to enable outbound traffic.

An enterprise is deploying internal workloads across multiple subnets in a Google Cloud VPC without public IP addresses. The organization must meet the following egress security and partner integration requirements:

Workloads in the payment subnet (10.10.1.0/24) must route outbound traffic to external payment gateways using a dedicated, reserved static external IP address (IP_ADDRESS_1) for IP whitelisting.
Workloads in the analytics subnet (10.10.2.0/24) must route outbound traffic to an external reporting endpoint using a separate reserved static external IP address (IP_ADDRESS_2).
All other private subnets in the VPC must route general outbound internet traffic through a default pool of static external IP addresses.

Which Cloud NAT configuration should the cloud security engineer implement?

Assign multiple secondary IP address aliases to each VM's network interface and configure Cloud NAT to map secondary alias ranges to external endpoints using port randomization.

Configure a Cloud NAT gateway with automatic IP allocation and create destination-based VPC firewall egress rules that rewrite source IP headers according to subnet tags.

Create custom static routes in the VPC routing table matching destination CIDRs and set the next-hop IP addresses directly to the reserved external IP addresses.

Configure a Cloud NAT gateway with manual IP allocation, specify a default external IP pool, and define Cloud NAT rules using CEL expressions with inIpRange(source.ip, ...) to assign dedicated --source-nat-active-ips per subnet.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Nat Source Based Rules Static Ip

Section: Using Cloud NAT to enable outbound traffic.

Workloads in the payment subnet (10.10.1.0/24) must route outbound traffic to external payment gateways using a dedicated, reserved static external IP address (IP_ADDRESS_1) for IP whitelisting.
Workloads in the analytics subnet (10.10.2.0/24) must route outbound traffic to an external reporting endpoint using a separate reserved static external IP address (IP_ADDRESS_2).
All other private subnets in the VPC must route general outbound internet traffic through a default pool of static external IP addresses.

Which Cloud NAT configuration should the cloud security engineer implement?

Assign multiple secondary IP address aliases to each VM's network interface and configure Cloud NAT to map secondary alias ranges to external endpoints using port randomization.

Configure a Cloud NAT gateway with automatic IP allocation and create destination-based VPC firewall egress rules that rewrite source IP headers according to subnet tags.

Create custom static routes in the VPC routing table matching destination CIDRs and set the next-hop IP addresses directly to the reserved external IP addresses.

Explanations

What Cloud NAT Rules with Manual IP Allocation Are

Cloud NAT rules allow fine-grained control over how network address translation maps internal traffic to specific external IP addresses based on matching criteria, such as source or destination IP ranges. Using manual IP allocation, administrators pre-allocate regional static external IP addresses and bind them deterministically to the gateway and specific NAT rules.

How it meets the requirements

Dedicated payment IP (10.10.1.0/24): A NAT rule configured with a Common Expression Language (CEL) match condition (inIpRange(source.ip, '10.10.1.0/24')) maps outbound packets from this subnet to --source-nat-active-ips=IP_ADDRESS_1.
Dedicated analytics IP (10.10.2.0/24): A second NAT rule with higher/lower priority matching inIpRange(source.ip, '10.10.2.0/24') maps outbound packets from the analytics subnet to --source-nat-active-ips=IP_ADDRESS_2.
Default fallback pool: Packets from other subnets that do not match the specific source rules automatically fall back to the default NAT rule and consume external IPs from the gateway's primary --nat-external-ip-pool.
Zero-trust and defense-in-depth: VMs remain private with no direct external IPs, preventing unsolicited ingress while providing deterministic egress attribution for external whitelisting.

Key advantages

Granular IP attribution: Enables distinct external IP whitelisting per subnet or workload type on a single gateway.
Dynamic CEL rule matching: Supports flexible source and destination filtering expressions.
Operational efficiency: Eliminates the need to deploy redundant gateways or multiple routing topologies across the VPC.
High availability and scale: Leverages Google Cloud's distributed software-defined NAT architecture without bottlenecking through intermediate proxy VMs.

Why this is optimal

This configuration adheres to least privilege and defense-in-depth principles by maintaining private VM network interfaces while fulfilling partner firewall whitelisting constraints using a centralized, software-defined Cloud NAT gateway.

View source documentation

Professional Cloud Security Engineer

Cloud Nat Source Based Rules Static Ip

Professional Cloud Security Engineer

Cloud Nat Source Based Rules Static Ip

What Cloud NAT Rules with Manual IP Allocation Are

How it meets the requirements

Key advantages

Why this is optimal

Related questions