Black Friday Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: validbest

Discussions
  1. Home
  2. Discussions
  3. Google
  4. Google Cloud Platform
  5. Professional-Cloud-Network-Engineer Discussions
  6. Professional-Cloud-Network-Engineer Exam Topic 1 Question 3 Discussion
 Google Discussions
Exam Professional-Cloud-Network-Engineer All Questions
Exam Professional-Cloud-Network-Engineer All Questions

View all questions & answers for the Professional-Cloud-Network-Engineer exam

Go to Exam

Google Cloud Platform Professional-Cloud-Network-Engineer Question # 3 Topic 1 Discussion

Professional-Cloud-Network-Engineer Exam Topic 1 Question 3 Discussion:
Question #: 3
Topic #: 1

You have several VMs across multiple VPCs in your cloud environment that require access to internet endpoints. These VMs cannot have public IP addresses due to security policies, so you plan to use Cloud NAT to provide outbound internet access. Within your VPCs, you have several subnets in each region. You want to ensure that only specific subnets have access to the internet through Cloud NAT. You want to avoid any unintentional configuration issues caused by other administrators and align to Google-recommended practices. What should you do?
A.

Deploy Cloud NAT in each VPC and configure a custom source range that includes the allowed subnets. Configure Cloud NAT rules to only permit the allowed subnets to egress through Cloud NAT.

B.

Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet (0.0.0.0/0). Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet (0.0.0.0/0). Deploy Cloud NAT and configure all primary and secondary subnet source ranges.

C.

Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet (0.0.0.0/0). Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet (0.0.0.0/0). Deploy Cloud NAT and configure a custom source range that includes the allowed subnets.

D.

Create a constraints/compute.restrictCloudNATUsage organizational policy constraint. Attach the constraint to a folder that contains the associated projects. Configure the allowedValues to only contain the subnets that should have internet access. Deploy Cloud NAT and select only the allowed subnets.

Get Premium Professional-Cloud-Network-Engineer Questions
Actual exam question for Google Professional-Cloud-Network-Engineer exam by Phoenix342 at Feb 11, 2025, 3:12:43 AM

Contribute your Thoughts:


Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.

Submit