Exam Associate Cloud Engineer All Questions

View all questions & answers for the Associate Cloud Engineer exam

Exam Associate Cloud Engineer topic 1 question 63 discussion

Actual exam question from Google's Associate Cloud Engineer

Question #: 63
Topic #: 1

[All Associate Cloud Engineer Questions]

You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?

A. 1. Use nslookup to get the IP address for storage.googleapis.com. 2. Negotiate with the security team to be able to give a public IP address to the servers. 3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com.
B. 1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud. 2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance. 3. Configure your servers to use that instance as a proxy to access Cloud Storage.
C. 1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine. 2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend. 3. Configure your new instances to use this ILB as proxy.
D. 1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in Google Cloud. 2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel. 3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com.

Show Suggested Answer

Suggested Answer: D 🗳️

by poogcp at June 10, 2020, 12:19 p.m.

Comments

Submit Cancel

poogcp

Highly Voted 4 years, 4 months ago

D is the correct one as per Ref: https://cloud.google.com/vpc/docs/configure-private-google-access-hybrid

upvoted 55 times

...

obeythefist

Highly Voted 2 years, 8 months ago

What messy answers! I chose D and here is my reasoning per answer. A. It's bad practice to use nslookup to try find a permanent IP address because IPs can change. That's what DNS is for! Also, the security team aren't going to budge... this is just a silly answer. B. We're getting warmer. Any time a question mentions on-prem and cloud, Google wants you to think about Cloud VPN. This solution might even work, but installing Squid? This is a messy solution to a more simple problem. C. Talk about using a sledge hammer to swat a mosquito. I think this could work, but migrating servers to cloud to solve a simple networking problem? D. Once more Google's favorite Cloud VPN is in the answer. I'm not sure about the networking component of this question.

upvoted 26 times

obeythefist

2 years, 8 months ago

Edit: Of course the reason D: is correct is because 199.36.153.4/30 is the network segment that you can direct traffic to if you want to use Google services "internally". So your on prem servers will resolve storage.googleapis.com to something in this 199.36.153.4/30 range. Then they will route using Cloud Router and your VPN tunnel into Google Cloud privately.

upvoted 15 times

...

Cloudmoh

Most Recent 2 months, 2 weeks ago

Selected Answer: D

Well D is the right option : . Using Cloud VPN or Interconnect, create a tunnel to a VPC in Google Cloud. 2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel. 3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com

upvoted 1 times

...

subha.elumalai

5 months, 1 week ago

C is the correct Answer

upvoted 1 times

...

BAofBK

12 months ago

The correct answer is D

upvoted 2 times

...

gsmasad

1 year ago

Selected Answer: D

D as per google recommened pratcises

upvoted 1 times

...

Captain1212

1 year, 2 months ago

Selected Answer: D

D as per google recommened pratcises

upvoted 1 times

...

Buruguduystunstugudunstuy

1 year, 8 months ago

Selected Answer: D

ANSWER D is the recommended solution because it provides a secure and direct connection to Cloud Storage without requiring internet access or exposing the servers to public IP addresses. * By setting up a VPN or Interconnect tunnel, the on-premises servers can access Google Cloud resources over a private and encrypted connection. * The custom route advertisement for 199.36.153.4/30 ensures that traffic is routed correctly between the on-premises network and Google Cloud. * Configuring the DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com ensures that requests are directed to Google Cloud over the VPN or Interconnect tunnel.

upvoted 9 times

...

warrior9000

1 year, 10 months ago

D but anyone wanna try to explain how the hell you can have a VPN connection without accessing the public internet? The only option for D should be using Interconnect for a direct private wire from your data center to GCP. VPN doesn't make any sense.

upvoted 6 times