A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet. How should this be accomplished?
A.
Create a firewall rule to block internet traffic from the VM.
B.
Provision a NAT Gateway to access the Cloud Storage API endpoint.
C.
Enable Private Google Access.
D.
Mount a Cloud Storage bucket as a local filesystem on every VM.
The ask is to store the output files in a Cloud storage bucket. "The networking and security teams have decided that no VMs may reach the public internet" - No VMs MAY reach public internet but not 'MUST'. Hence 'C' is the answer
The answer is A....
With GPA enabled, VMs can still reach the Internet. Accessing the backend storage is ther to throw you off of what is being asked - and that's NO VMs may reach the Internet...
Answer is A
To ensure that VMs can access Cloud Storage without reaching the public internet, you should:
C. Enable Private Google Access.
Enabling Private Google Access allows VMs with only internal IP addresses in a VPC network to access Google Cloud services like Cloud Storage without needing external IP addresses or going through the public internet.
Option B, provisioning a NAT Gateway, would enable VMs to access the public internet, which is not in line with the requirement of not allowing VMs to reach the public internet.
Options A and D are not suitable for the specific requirement of accessing Cloud Storage while preventing VMs from reaching the public internet.
B. Provision a NAT Gateway to access the Cloud Storage API endpoint.
Explanation:
To ensure that VMs can't reach the public internet but can still access Google Cloud services like Cloud Storage, you can use a Network Address Translation (NAT) Gateway. NAT Gateway allows instances in a private subnet to initiate outbound connections to the internet while masking their actual internal IP addresses. This way, the VMs can access the Cloud Storage API endpoint without directly connecting to the public internet.
"C"
The question is not worded well. If you replace "..has decided.." with "..has enforced.." then the meat of the question becomes how to achieve the first part of the requirement which is reaching cloud storage without public access, which is through private google access.
Reference:
https://cloud.google.com/vpc/docs/private-google-access
This has no effect and is meaningless if the VM has an external IP... You need to read the document:
'Private Google Access has no effect on instances that have external IP addresses. Instances with external IP addresses can access the internet, according to the internet access requirements'...
No where in the question say the VMs has or hasn't have an ext. IP.
Correct Answer is A
that not what they asked... they asked 'The networking and security teams have decided that no VMs may reach the public internet'.... so what do you do?
Answer C:
Here is why; the VM need to access google service i.e. "Cloud Storage Bucket".
Google doc states: Private Google Access permits access to Google APIs and services in Google's production infrastructure
https://cloud.google.com/vpc/docs/private-google-access
Everyone is reading the question as limited access to public internet but is missing the 2nd part of the question, which is access a google services. ONLY enable Private Google Access will fulfil the requirement.
The ask is to access cloud storage while doing the batch processing not how to block the internet.
Overall it’s a poor choice of words in the question attempting to confuse than check knowledge
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
tanfromvn
Highly Voted 3 years, 4 months agomynk29
2 years, 8 months agonilopo
Highly Voted 2 years, 1 month agodesertlotus1211
Most Recent 8 months, 2 weeks agoPortugapt
9 months, 1 week agodesertlotus1211
10 months ago[Removed]
10 months, 2 weeks agoXoxoo
1 year, 1 month agoXoxoo
1 year, 1 month agoblacortik
1 year, 2 months ago[Removed]
1 year, 3 months agodesertlotus1211
1 year, 2 months agogcpengineer
1 year, 5 months agogcpengineer
1 year, 5 months agogcpengineer
1 year, 5 months agoLyfedge
1 year, 7 months agogcpengineer
1 year, 5 months agodesertlotus1211
10 months agoMeyucho
1 year, 10 months agoTonytheTiger
1 year, 11 months agoLittleivy
1 year, 11 months agorotorclear
2 years agoAzureDP900
1 year, 12 months agoAwesomeGCP
2 years ago