Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Google Professional Cloud Security Engineer Exam - Topic 3 Question 122 Discussion

Your DevOps team uses Packer to build Compute Engine images by using this process:1 Create an ephemeral Compute Engine VM.2 Copy a binary from a Cloud Storage bucket to the VM's file system.3 Update the VM's package manager.4 Install external packages from the internet onto the VM.Your security team just enabled the organizational policy. consrraints/compure.vnExtemallpAccess. to restrict the usage of public IP Addresses on VMs. In response your DevOps team updated their scripts to remove public IP addresses on the Compute Engine VMs however the build pipeline is failing due to connectivity issues.What should you do?Choose 2 answers
A) Provision a Cloud NAT instance in the same VPC and region as the Compute Engine VM and E) Enable Private Google Access on the subnet that the Compute Engine VM is deployed within.
B) Provision an HTTP load balancer with the VM in an unmanaged instance group to allow inbound connections from the internet to your VM.
C) Update the VPC routes to allow traffic to and from the internet.
D) Provision a Cloud VPN tunnel in the same VPC and region as the Compute Engine VM.

Google Professional Cloud Security Engineer Exam - Topic 3 Question 122 Discussion

Actual exam question for Google's Professional Cloud Security Engineer exam
Question #: 122
Topic #: 3
[All Professional Cloud Security Engineer Questions]

Your DevOps team uses Packer to build Compute Engine images by using this process:

1 Create an ephemeral Compute Engine VM.

2 Copy a binary from a Cloud Storage bucket to the VM's file system.

3 Update the VM's package manager.

4 Install external packages from the internet onto the VM.

Your security team just enabled the organizational policy. consrraints/compure.vnExtemallpAccess. to restrict the usage of public IP Addresses on VMs. In response your DevOps team updated their scripts to remove public IP addresses on the Compute Engine VMs however the build pipeline is failing due to connectivity issues.

What should you do?

Choose 2 answers

Show Suggested Answer Hide Answer
Suggested Answer: A, E

Provision a Cloud NAT Instance:

Cloud NAT (Network Address Translation) allows instances without external IP addresses to access the internet securely.

In the Google Cloud Console, navigate to the VPC Network section and select Cloud NAT.

Create a new Cloud NAT configuration, specifying the VPC and region where your Compute Engine VMs are deployed.

Configure Cloud NAT:

Ensure that the Cloud NAT instance is configured to provide outbound internet connectivity for the VMs in your specified subnet.

This setup allows the VMs to access the internet for package updates and external installations without requiring public IP addresses.

Enable Private Google Access:

Private Google Access allows VMs in a subnet to reach Google APIs and services using internal IP addresses.

In the Google Cloud Console, navigate to the VPC Network section and select Subnets.

Edit the subnet used by your Compute Engine VMs and enable Private Google Access.

Update DevOps Scripts:

Ensure that your DevOps scripts are updated to work with the new network configuration.

Test the build process to confirm that the VMs can access necessary resources and complete the build pipeline successfully.


Cloud NAT Documentation

Private Google Access

by Cherilyn at Aug 14, 2026, 09:36 AM

Limited Time Offer

25%

Off

Get Premium Professional Cloud Security Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel

Currently there are no comments in this discussion, be the first to comment!


Save Cancel