Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ19

Securing communications and establishing boundary protection

You need to configure a Cloud Interconnect connection between your company’s on-premises data center and a VPC host network. You want to ensure that on-premises applications can access Google APIs only over Cloud Interconnect, rather than through the public internet. You must use only APIs supported by VPC Service Controls to mitigate the risk of exfiltration to unsupported APIs. How should the network be configured?

  • A Enable Private Google Access on the regional subnets and global dynamic routing mode.
  • B Create a CNAME to map *.googleapis.com to restricted.googleapis.com, and create A records for restricted.googleapis.com mapped to 199.36.153.8/30.
  • C Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
  • D Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
Explanation

restricted.googleapis.com uses the restricted VIP, which is intended for APIs and services supported by VPC Service Controls and denies access to unsupported APIs. Advertising its VIP range to the on-premises network through Cloud Router over Cloud Interconnect lets on-premises requests reach Google APIs privately through the VPC rather than via the public internet.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!