Associate Cloud EngineerDemo

By Google · Question Mode

QuestionQ5

Configuring access and security

You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?

  • A
    1. Use nslookup to get the IP address for storage.googleapis.com. 2. Negotiate with the security team to be able to give a public IP address to the servers. 3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com.
  • B
    1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud. 2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance. 3. Configure your servers to use that instance as a proxy to access Cloud Storage.
  • C
    1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine. 2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend. 3. Configure your new instances to use this ILB as proxy.
  • D
    1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in Google Cloud. 2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel. 3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com.
Explanation

Google's documented solution for this scenario is Private Google Access for on-premises hosts. It requires establishing private connectivity between the on-premises network and a Google Cloud VPC using Cloud VPN or Cloud Interconnect, then using Cloud Router to advertise a custom route for the restricted.googleapis.com virtual IP range (199.36.153.4/30) over that tunnel so on-premises traffic destined for Google APIs is routed privately rather than over the public internet. On the on-premises side, DNS must be configured so that requests to *.googleapis.com (including storage.googleapis.com) resolve via a CNAME to restricted.googleapis.com, which resolves to the 199.36.153.4/30 VIP range. Because this IP range is never announced publicly and is only reachable through the private VPN/Interconnect link, on-premises bare-metal servers can reach Cloud Storage without ever having a public IP address or open internet egress, while restricted.googleapis.com additionally limits access to only APIs/services supported by VPC Service Controls, reducing data-exfiltration risk. See Google Cloud's documentation, 'Private Google Access for on-premises hosts' and 'Configure Private Google Access for on-premises hosts.'

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!