Exam Professional Cloud Network Engineer topic 1 question 26 discussion

Actual exam question from Google's Professional Cloud Network Engineer

Question #: 26
Topic #: 1

[All Professional Cloud Network Engineer Questions]

You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have external IP addresses.
Which two methods can you use to accomplish this? (Choose two.)

A. Enable Private Google Access on all the subnets.
B. Enable Private Google Access on the VPC.
C. Enable Private Services Access on the VPC.
D. Create network peering between your VPC and BigQuery.
E. Create a Cloud NAT, and route the application traffic via NAT gateway.

Show Suggested Answer

Suggested Answer: AE 🗳️

by ESP_SAP at Nov. 2, 2020, 3:54 a.m.

Comments

Submit Cancel

ESP_SAP

Highly Voted 3 years ago

Correct answers are (A) & (E) Private Google Access interaction https://cloud.google.com/nat/docs/overview#interaction-pga Specifications https://cloud.google.com/vpc/docs/configure-private-google-access#specifications

upvoted 21 times

...

otokichi3

Highly Voted 11 months, 4 weeks ago

Selected Answer: AE

A & E but these don't prevent instances having external IP, so truly correct answers are missing.

upvoted 8 times

...

saraali

Most Recent 2 months, 2 weeks ago

Selected Answer: AE

The correct options are: AE. A ensures that instances without external IPs can still access Google services like BigQuery and Cloud Storage using internal IPs. E allows instances without external IPs to access external services through a Cloud NAT gateway, maintaining no external IP on the instances.

upvoted 1 times

...

mcjim

5 months, 2 weeks ago

Selected Answer: AE

BigQuery doesn't support Private Services Access so it cannot be C https://cloud.google.com/vpc/docs/private-services-access#private-services-supported-services

upvoted 1 times

...

Komal697

7 months ago

Selected Answer: AB

Option A, "Enable Private Google Access on all the subnets," is incorrect because it enables private communication between VM instances and Google APIs and services using Google's private IP space, but it does not prevent VM instances from having external IP addresses. Option E, "Create a Cloud NAT and route the application traffic via NAT gateway," is incorrect because Cloud NAT does not prevent VM instances from having external IP addresses. Cloud NAT provides a way to NAT VM instances' egress traffic to the Internet, but it does not control whether the VM instances have external IP addresses. Option A and B together are correct because enabling Private Google Access on all subnets and the VPC restricts communication to Google APIs and services to only use Google's private IP space. This configuration prevents instances in the VPC from using external IP addresses to communicate with Google APIs and services.

upvoted 1 times

Komal697

7 months ago

C. Enabling Private Services Access on the VPC allows private access to Google services with endpoint filtering, but it is not relevant to accessing BigQuery or Cloud Storage. D. Creating network peering between your VPC and BigQuery is not a suitable solution, as BigQuery does not support VPC Network Peering.

upvoted 1 times

...