Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
An enterprise maintains hybrid workloads in an on-premises data center connected to a Google Cloud Virtual Private Cloud (VPC) via Dedicated Interconnect. The organization enforces a VPC Service Controls (VPC-SC) perimeter around its cloud projects to prevent data exfiltration. The security team mandates that on-premises servers must access Google APIs privately through the Interconnect link without traversing the public internet, and all API traffic must be strictly governed by the VPC Service Controls perimeter.
Which combination of routing and DNS configurations should you implement to satisfy these security requirements?
Private Google Access for on-premises hosts allows systems outside Google Cloud (such as servers in an on-premises data center) to reach Google APIs and services privately over Cloud Interconnect or Cloud VPN using private or restricted Virtual IP (VIP) addresses.
StudyCerts
StudyCertsrestricted.googleapis.com domain resolves to the 199.36.153.4/30 CIDR block (199.36.153.4, 199.36.153.5, 199.36.153.6, and 199.36.153.7). By configuring custom BGP route advertisements on Cloud Router, the 199.36.153.4/30 prefix is announced to on-premises edge routers, establishing a private network path over Cloud Interconnect.restricted.googleapis.com ensures that only APIs supported by VPC Service Controls are accessible, completely blocking access to unsupported Google services and preventing perimeter data exfiltration.googleapis.com queries to these inbound entry points, where a private DNS zone or DNS Response Policy aliases *.googleapis.com to restricted.googleapis.com.This architecture establishes end-to-end private connectivity while adhering to the principle of least privilege at the network boundary, ensuring that hybrid traffic cannot bypass VPC Service Controls perimeter policies.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.