Professional Cloud Security Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise is deploying internal workloads across multiple subnets in a Google Cloud VPC without public IP addresses. The organization must meet the following egress security and partner integration requirements:
StudyCerts
StudyCerts10.10.1.0/24) must route outbound traffic to external payment gateways using a dedicated, reserved static external IP address (IP_ADDRESS_1) for IP whitelisting.10.10.2.0/24) must route outbound traffic to an external reporting endpoint using a separate reserved static external IP address (IP_ADDRESS_2).Which Cloud NAT configuration should the cloud security engineer implement?
Create custom static routes in the VPC routing table matching destination CIDRs and set the next-hop IP addresses directly to the reserved external IP addresses.
Assign multiple secondary IP address aliases to each VM's network interface and configure Cloud NAT to map secondary alias ranges to external endpoints using port randomization.
Configure a Cloud NAT gateway with automatic IP allocation and create destination-based VPC firewall egress rules that rewrite source IP headers according to subnet tags.
Configure a Cloud NAT gateway with manual IP allocation, specify a default external IP pool, and define Cloud NAT rules using CEL expressions with inIpRange(source.ip, ...) to assign dedicated --source-nat-active-ips per subnet.
Create custom static routes in the VPC routing table matching destination CIDRs and set the next-hop IP addresses directly to the reserved external IP addresses.
Assign multiple secondary IP address aliases to each VM's network interface and configure Cloud NAT to map secondary alias ranges to external endpoints using port randomization.
Configure a Cloud NAT gateway with automatic IP allocation and create destination-based VPC firewall egress rules that rewrite source IP headers according to subnet tags.
Configure a Cloud NAT gateway with manual IP allocation, specify a default external IP pool, and define Cloud NAT rules using CEL expressions with inIpRange(source.ip, ...) to assign dedicated --source-nat-active-ips per subnet.
Cloud NAT rules allow fine-grained control over how network address translation maps internal traffic to specific external IP addresses based on matching criteria, such as source or destination IP ranges. Using manual IP allocation, administrators pre-allocate regional static external IP addresses and bind them deterministically to the gateway and specific NAT rules.
10.10.1.0/24): A NAT rule configured with a Common Expression Language (CEL) match condition (inIpRange(source.ip, '10.10.1.0/24')) maps outbound packets from this subnet to --source-nat-active-ips=IP_ADDRESS_1.10.10.2.0/24): A second NAT rule with higher/lower priority matching inIpRange(source.ip, '10.10.2.0/24') maps outbound packets from the analytics subnet to --source-nat-active-ips=IP_ADDRESS_2.--nat-external-ip-pool.This configuration adheres to least privilege and defense-in-depth principles by maintaining private VM network interfaces while fulfilling partner firewall whitelisting constraints using a centralized, software-defined Cloud NAT gateway.