Professional Cloud ArchitectDemo

By Google · Question Mode

QuestionQ260

Designing and planning a cloud solution architecture

You are setting up the cloud network architecture for a newly created Google Cloud project that will host applications on Compute Engine. Compute Engine virtual machine instances will be created in two separate subnets (sub-a and sub-b) in one region:

  • Instances in sub-a will have public IP addresses.
  • Instances in sub-b will have private IP addresses only.

To download updated packages, the instances must connect to a public repository outside Google Cloud boundaries. You need to enable sub-b to access the external repository. What should you do?

  • A Enable Private Google Access on sub-b.
  • B Configure Cloud NAT and select sub-b in the NAT mapping section.
  • C Configure a bastion host instance in sub-a to connect to instances in sub-b.
  • D Enable Identity-Aware Proxy for TCP forwarding for instances in sub-b.
Explanation

Public Cloud NAT lets Compute Engine VMs without external IP addresses initiate outbound connections to internet destinations while receiving only response traffic for those established connections. Configuring the NAT gateway to apply to sub-b provides the required package-repository access without assigning public IP addresses to its instances.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!