Exam Professional Cloud Network Engineer topic 1 question 182 discussion

Actual exam question from Google's Professional Cloud Network Engineer

Question #: 182
Topic #: 1

[All Professional Cloud Network Engineer Questions]

You have several VMs across multiple VPCs in your cloud environment, which require access to internet endpoints. These VMs cannot have public IP addresses due to security policies, so you plan to use Cloud NAT to provide outbound internet access. Within your VPCs, you have several subnets in each region. You want to ensure that only specific subnets have access to the internet through Cloud NAT. You want to avoid any unintentional configuration issues caused by other administrators, and align to Google-recommended practices. What should you do?

A. Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet, 0.0.0.0/0. Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet, 0.0.0.0/0. Deploy Cloud NAT, and configure all primary and secondary subnet source ranges.
B. Create a constraints/compute.restrictCloudNATUsage organizational policy constraint. Attach the constraint to a folder that contains the associated projects. Configure the allowedValues to only contain the subnets that should have internet access. Deploy Cloud NAT and select only the allowed subnets.
C. Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet, 0.0.0.0/0. Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet, 0.0.0.0/0. Deploy Cloud NAT, and configure a custom source range that includes the allowed subnets.
D. Deploy Cloud NAT in each VPC, and configure a custom source range that includes the allowed subnets. Configure Cloud NAT rules to only permit the allowed subnets to egress through Cloud NAT.

Show Suggested Answer

Suggested Answer: B 🗳️

by RKS_2021 at Feb. 23, 2025, 5:14 a.m.

Comments

Submit Cancel

n2183712847

1 month, 2 weeks ago

Selected Answer: B

B makes most sense

upvoted 1 times

...

bilol

3 months, 2 weeks ago

Selected Answer: B

Organizational policy constraints provide a centralized and enforced way to restrict Cloud NAT usage to specific subnets

upvoted 1 times

...

RKS_2021

3 months, 3 weeks ago

Selected Answer: B

b is correct ans

upvoted 3 times

...