Google Professional Cloud Network Engineer Exam - Topic 3 Question 102 Discussion

Actual exam question for Google's Professional Cloud Network Engineer exam

Question #: 102
Topic #: 3

[All Professional Cloud Network Engineer Questions]

You have several VMs across multiple VPCs in your cloud environment that require access to internet endpoints. These VMs cannot have public IP addresses due to security policies, so you plan to use Cloud NAT to provide outbound internet access. Within your VPCs, you have several subnets in each region. You want to ensure that only specific subnets have access to the internet through Cloud NAT. You want to avoid any unintentional configuration issues caused by other administrators and align to Google-recommended practices. What should you do?

ADeploy Cloud NAT in each VPC and configure a custom source range that includes the allowed subnets. Configure Cloud NAT rules to only permit the allowed subnets to egress through Cloud NAT.

BCreate a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet (0.0.0.0/0). Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet (0.0.0.0/0). Deploy Cloud NAT and configure all primary and secondary subnet source ranges.

CCreate a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet (0.0.0.0/0). Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet (0.0.0.0/0). Deploy Cloud NAT and configure a custom source range that includes the allowed subnets.

DCreate a constraints/compute.restrictCloudNATUsage organizational policy constraint. Attach the constraint to a folder that contains the associated projects. Configure the allowedValues to only contain the subnets that should have internet access. Deploy Cloud NAT and select only the allowed subnets.

Show Suggested Answer

Suggested Answer: D

Using an organizational policy with the restrictCloudNATUsage constraint allows you to limit Cloud NAT usage to specific subnets, ensuring that only the necessary subnets can access the internet. This method aligns with Google-recommended practices for controlling Cloud NAT configurations across multiple VPCs and regions.

by Kirk at Feb 08, 2025, 02:29 PM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Network Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Colette

4 months ago

C looks solid, but I’d double-check those priorities.

upvoted 0 times

...

Julian

5 months ago

Wait, can you really restrict Cloud NAT usage like that?

upvoted 0 times

...

Jeff

5 months ago

B seems like it could lead to confusion with multiple rules.

upvoted 0 times

...

Barrett

5 months ago

I think D is a bit overkill for this scenario.

upvoted 0 times

...

Reuben

5 months ago

A is the best option for controlling egress!

upvoted 0 times

...

Ceola

6 months ago

I feel like option D might be the best approach since it includes organizational policies, but I’m not entirely clear on how to implement those constraints.

upvoted 0 times

...

Tawna

6 months ago

I practiced a similar question where we had to set up firewall rules, but I can't recall if we needed to create multiple rules like in option B or C.

upvoted 0 times

...

Bok

6 months ago

I think option A sounds familiar, but I’m a bit confused about how to configure the custom source range correctly.

upvoted 0 times

...

Lemuel

6 months ago

I remember we discussed Cloud NAT in class, but I'm not sure if we covered how to restrict access to specific subnets effectively.

upvoted 0 times

...

Phil

6 months ago

Option D seems like a good way to enforce the allowed subnets using the organizational policy constraint. This could help prevent any unintentional configuration issues by other administrators. I'll need to research how to properly set up and apply the constraint.

upvoted 0 times

...

Paola

6 months ago

I'm a bit confused by the different firewall rule options. I'll need to review the details of each approach to understand the differences and ensure I select the most appropriate solution.

upvoted 0 times

...

Jess

6 months ago

Option C looks like the best approach to me. By creating the firewall rules to deny and allow internet access based on the allowed subnets, we can ensure that only the specific subnets have access through Cloud NAT. This aligns with the Google-recommended practices.

upvoted 0 times

...

Desmond

6 months ago

This question seems straightforward, but I want to make sure I understand the requirements correctly. I'll need to carefully review the options and think through the implications of each approach.

upvoted 0 times

...

James

1 year ago

I hear the correct answer is 42. Google's always got the hitchhiker's guide to the cloud, you know?

upvoted 0 times

Bernardine

1 year ago

D) Create a constraints/compute.restrictCloudNATUsage organizational policy constraint. Attach the constraint to a folder that contains the associated projects. Configure the allowedValues to only contain the subnets that should have internet access. Deploy Cloud NAT and select only the allowed subnets.

upvoted 0 times

...

Cherry

1 year ago

C) Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet (0.0.0.0/0). Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet (0.0.0.0/0). Deploy Cloud NAT and configure a custom source range that includes the allowed subnets.

upvoted 0 times

...

Hyun

1 year ago

B) Create a firewall rule in each VPC at priority 500 that targets all instances in the network and denies egress to the internet (0.0.0.0/0). Create a firewall rule at priority 300 that targets all instances in the network, has a source filter that maps to the allowed subnets, and allows egress to the internet (0.0.0.0/0). Deploy Cloud NAT and configure all primary and secondary subnet source ranges.

upvoted 0 times

...

Alaine

1 year ago

A) Deploy Cloud NAT in each VPC and configure a custom source range that includes the allowed subnets. Configure Cloud NAT rules to only permit the allowed subnets to egress through Cloud NAT.

upvoted 0 times

...

Mickie

1 year ago

Why not just give all the VMs a shared 'Internet Superhighway' bus pass? That'll solve the security issues, right?

upvoted 0 times

Eliz

1 year ago

upvoted 0 times

...

Sheron

1 year ago

upvoted 0 times

...

Isreal

1 year ago

Option A is the way to go! Who needs all those fancy firewall rules and organizational policies when you can just configure Cloud NAT directly? Keep it simple, silly!

upvoted 0 times

Angella

1 year ago

Yeah, I prefer keeping things simple too. Option A is definitely the way to go in this case.

upvoted 0 times

...

Jerry

1 year ago

I agree, simplicity is key. Option A seems like the most straightforward approach.

upvoted 0 times

...

Buck

1 year ago

I'm not sure about option A. I think option D might be a better approach by using organizational policy constraints to restrict Cloud NAT usage to specific subnets.

upvoted 0 times

...