An enterprise has deployed a backend microservice on Cloud Run with its ingress setting configured to internal to prevent direct exposure to the public internet. The security team needs to allow a frontend application running in App Engine standard environment within the same Google Cloud project to privately invoke this Cloud Run service. Which architecture should the security team implement to satisfy these requirements?

Attach the App Engine service to a Serverless VPC Access connector, enable Private Google Access on the connector's subnet, and configure the App Engine service to route all egress traffic through the connector.: What the Serverless VPC Access Architecture Is Serverless VPC Access bridges Google Cloud serverless runtimes (such as App Engine standard, Cloud Run, and Cloud Functions) to a Virtual Private Cloud (VPC) network. Attaching a serverless service to a dedicated connector enables private egress into the VPC without allocating public IP addresses to individual serverless application instances. How It Meets the Requirements Internal Ingress Alignment: A destination Cloud Run service set to internal only accepts requests that originate from inside an authorized VPC network or arrive via approved private paths. Serverless requests must traverse a VPC network to be recognized as internal traffic. Private Network Path: Configuring the App Engine service to route all-traffic through the Serverless VPC Access connector forces all outbound traffic into the VPC subnet. Private Google Access Enforcement: Enabling Private Google Access on the connector's subnet ensures that requests destined for Google APIs and run.app endpoints route privately through Google's internal network infrastructure rather than exiting to the public internet. Key Advantages and Capabilities Zero Public Exposure: Eliminates the need for public IP addresses or external internet gateways on either the producer or consumer workloads. Granular Egress Control: Allows centralized firewall rules and route tables to inspect and govern outbound traffic originating from serverless runtimes. Seamless Protocol Handling: Delivers native TLS encryption and identity propagation across serverless services within Google's private backbone. Full Enterprise Governance: Integrates directly with VPC Service Controls and organization policy constraints. Why This Is Optimal Routing all-traffic through the connector while enabling Private Google Access on the connector subnet directly fulfills Google Cloud's architectural requirements for serverless-to-serverless internal communication, guaranteeing strict perimeter security without complex reverse proxies.

Secure Serverless Private Egress Cloud Run | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise is designing a multi-tier perimeter security architecture in Google Cloud for containerized workloads hosted on Compute Engine VMs, alongside a dedicated virtual security appliance. The deployment must satisfy the following networking and boundary requirements: Due to RFC 1918 address space exhaustion on-premises, custom VPC subnets must utilize alternative valid private address ranges, such as RFC 6598 (100.64.0.0/10), without violating Google Cloud subnet allocation rules. Individual containers running on each host VM must each receive their own dedicated, internally routable IP address from a secondary subnet range for granular firewall policy enforcement without adding physical network interfaces. The virtual security appliance VM must connect directly to two distinct VPC networks (vpc-untrusted and vpc-trusted) to inspect and filter transit traffic between them. Which configuration should the enterprise implement to satisfy these requirements?

Differentiating between private and public IP addressing.

AdvancedProfessional Cloud Security Engineer

A financial enterprise is securing its Google Cloud environment to minimize perimeter attack surfaces and prevent unintended internet exposure. The security architect establishes the following requirements: Prevent all Compute Engine virtual machines (VMs) across the organization from being assigned public external IPv4 addresses by default. Allow private VMs without external IP addresses to initiate outbound connections to external public APIs and package repositories. Provide secure administrative access (SSH and RDP) to these private VMs without deploying public bastion hosts or VPN appliances. Terminate public inbound web traffic at a scalable perimeter edge before routing requests to internal backend VMs. Which combination of architectural controls and services should the security architect deploy?

Differentiating between private and public IP addressing.

AdvancedProfessional Cloud Security Engineer

An enterprise organization is designing a centralized logging, threat detection, and security analytics architecture across Google Cloud and hybrid environments. The Security Operations Center (SOC) team needs to achieve the following requirements: Ingest and normalize diverse log sources (including cloud audit logs, web proxy logs, and endpoint telemetry) into a standard schema for fast threat hunting and multi-event correlation. Write custom behavioral detection rules that correlate disparate entities (such as IP addresses, users, and processes) across time windows. Integrate native Google Cloud threat intelligence findings alongside third-party telemetry in a single security analytics repository. Which logging and threat detection strategy should the organization implement?

Designing an effective logging strategy.

AdvancedProfessional Cloud Security Engineer

A financial enterprise is designing a centralized logging and compliance architecture across all Google Cloud projects in its organization. The compliance and security teams have established the following requirements: All Admin Activity and Data Access audit logs must be retained for 5 years (1,825 days) to meet regulatory retention mandates. Audit logs must be protected against tampering, early deletion, and unauthorized modification using write-once-read-many (WORM) immutability. Log storage costs must be optimized by automatically transitioning older log data to Coldline storage after 90 days. Security auditors must have read-only access to view the archived log objects without being able to modify access policies or delete data. Which logging and storage strategy should the enterprise implement to satisfy these requirements?

Designing an effective logging strategy.

AdvancedProfessional Cloud Security Engineer

A financial enterprise processes sensitive market data across Compute Engine instances, BigQuery datasets, and Cloud Storage buckets within Google Cloud. A security review identifies two primary data exfiltration threats: A compromised internal workload or malicious insider using valid credentials to copy proprietary BigQuery analytical data to an external, unauthorized Google Cloud storage destination. An administrator inadvertently misconfiguring IAM policies on a Cloud Storage bucket, granting read access to external or public entities. Which perimeter security architecture should the cloud security engineer implement to mitigate both exfiltration vectors?

Identifying use cases and configuring VPC Service Controls.

IntermediateProfessional Cloud Architect

Vertex AI Model Garden Deployment with Cloud Deploy

Integrating AI models from Model Garden into the solution

Professional Cloud Security Engineer

Secure Serverless Private Egress Cloud Run

Related questions

Vertex AI Model Garden Deployment with Cloud Deploy

Professional Cloud Security Engineer

Secure Serverless Private Egress Cloud Run

What the Serverless VPC Access Architecture Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions

Vertex AI Model Garden Deployment with Cloud Deploy

What the Serverless VPC Access Architecture Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal