Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Configure Private Google Access Vpc Service Controls

Section: Establishing private connectivity between VPC and Google APIs (Private Google Access, Private Google Access for on-premises hosts, restricted Google access, Private Service Connect).

An enterprise is deploying Compute Engine virtual machines without external IP addresses in a custom subnet (10.10.1.0/24). The workloads need to securely communicate with Cloud Storage and Artifact Registry while preventing data exfiltration to non-supported external services by leveraging an active VPC Service Controls security perimeter.

The VPC network enforces a strict baseline egress policy with an explicit low-priority deny rule for 0.0.0.0/0.

Which set of actions should the security engineer take to establish connectivity while maintaining network isolation and security perimeter enforcement?

Enable Private Google Access on the subnet, configure Cloud DNS to resolve *.googleapis.com and *.pkg.dev to private.googleapis.com (199.36.153.8/30), ensure a route exists for 199.36.153.8/30 to the default internet gateway, and create an egress allow firewall rule for 199.36.153.8/30 on TCP port 443.

Deploy a Cloud NAT gateway in the VPC network region, assign it to the subnet, and configure an egress allow firewall rule targeting destination 0.0.0.0/0 on TCP port 443.

Enable Private Google Access on the subnet, configure Cloud DNS to resolve *.googleapis.com and *.pkg.dev to restricted.googleapis.com (199.36.153.4/30), ensure a default route exists to the default internet gateway for 199.36.153.4/30, and create an egress allow firewall rule for 199.36.153.4/30 on TCP port 443.

Configure Private services access by establishing VPC Network Peering with Google's service producer network, and add an ingress allow firewall rule for the peered subnet range.

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Configure Private Google Access Vpc Service Controls

Section: Establishing private connectivity between VPC and Google APIs (Private Google Access, Private Google Access for on-premises hosts, restricted Google access, Private Service Connect).

The VPC network enforces a strict baseline egress policy with an explicit low-priority deny rule for 0.0.0.0/0.

Which set of actions should the security engineer take to establish connectivity while maintaining network isolation and security perimeter enforcement?

Deploy a Cloud NAT gateway in the VPC network region, assign it to the subnet, and configure an egress allow firewall rule targeting destination 0.0.0.0/0 on TCP port 443.

Configure Private services access by establishing VPC Network Peering with Google's service producer network, and add an ingress allow firewall rule for the peered subnet range.

Explanations

What Private Google Access with the Restricted VIP Is

Private Google Access (PGA) allows Compute Engine instances with only internal IP addresses to reach Google APIs and services through internal Google network pathways. When paired with VPC Service Controls (VPC-SC), traffic must be directed to the restricted VIP domain (restricted.googleapis.com), which maps to 199.36.153.4/30.

How It Meets the Requirements

Subnet Private Google Access: Enabling PGA at the subnet level permits instances without external IP addresses to send traffic to Google API IP ranges over Google's internal software-defined network infrastructure.
VPC Service Controls compliance: Directing DNS queries for *.googleapis.com and *.pkg.dev to restricted.googleapis.com resolves endpoints to 199.36.153.4/30, which strictly allows only APIs supported by VPC Service Controls and blocks non-supported services, mitigating risk of data exfiltration.
Routing: A route targeting 199.36.153.4/30 (or 0.0.0.0/0) with the default internet gateway next hop is required by Google Cloud's routing layer to direct internal API traffic to Google infrastructure.
Firewall isolation: Overriding the default deny-all egress rule with an explicit egress allow firewall rule targeting 199.36.153.4/30 on TCP port 443 maintains tight boundary isolation while permitting necessary API traffic.

Key Advantages

Enforces perimeter security: Prevents data egress to unsupported public APIs that could bypass VPC Service Controls.
No public exposure: Compute Engine VMs remain strictly private without public IPv4 addresses or NAT gateways.
Zero internet traversal: Packets never leave Google's internal backbone network.
Granular policy enforcement: Limits egress to a single /30 prefix, keeping network attack surfaces minimal.

Why This Is Optimal

This solution meets all functional, routing, firewall, and VPC-SC perimeter security requirements without introducing unneeded infrastructure or exposing internal workloads to broader network ranges.

View source documentation

Professional Cloud Security Engineer

Configure Private Google Access Vpc Service Controls

Professional Cloud Security Engineer

Configure Private Google Access Vpc Service Controls

What Private Google Access with the Restricted VIP Is

How It Meets the Requirements

Key Advantages

Why This Is Optimal

Related questions