Associate Cloud EngineerDemo

By Google · Question Mode

QuestionQ28

Configuring access and security

Your organization runs workloads on Compute Engine as well as on-premises, and your Google Cloud Virtual Private Cloud (VPC) is connected to your on-premises WAN via a Virtual Private Network (VPN). You need to deploy a new Compute Engine instance while ensuring that no public Internet traffic can be routed to it. What should you do?

  • A Create the instance without a public IP address.
  • B Create the instance with Private Google Access enabled.
  • C Create a deny-all egress firewall rule on the VPC network.
  • D Create a route on the VPC to route all traffic to the instance over the VPN tunnel.
Explanation

Compute Engine instances only become reachable from the public Internet when they are assigned an external (public) IP address. By provisioning the instance with only an internal IP address, it cannot receive inbound traffic from the Internet, while it remains reachable from on-premises networks and other VPC resources through the existing VPN connection and internal routing. This approach directly satisfies the requirement of blocking public Internet access without disrupting private connectivity over the VPN tunnel.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!