Professional Cloud Security EngineerDemo

By Google · Question Mode

QuestionQ217

Securing communications and establishing boundary protection

You need to connect your organization's on-premises network to an existing Google Cloud environment that contains one Shared VPC with two subnets named Production and Non-Production. You must:

  • Use a private transport link.
  • Configure access to Google Cloud APIs through private API endpoints from on-premises environments.
  • Ensure that Google Cloud APIs are consumed only through VPC Service Controls.

What should you do?

  • A
    1. Set up a Cloud VPN link between the on-premises environment and Google Cloud. 2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.
  • B
    1. Set up a Partner Interconnect link between the on-premises environment and Google Cloud. 2. Configure private access using the private.googleapis.com domains in on-premises DNS configurations.
  • C
    1. Set up a Direct Peering link between the on-premises environment and Google Cloud. 2. Configure private access for both VPC subnets.
  • D
    1. Set up a Dedicated Interconnect link between the on-premises environment and Google Cloud. 2. Configure private access using the restricted.googleapis.com domains in on-premises DNS configurations.
Explanation

Dedicated Interconnect provides dedicated private connectivity from an on-premises network to a Google Cloud VPC. For Private Google Access from on-premises hosts when API consumption must be limited to services supported by VPC Service Controls, requests must be routed through the VPC and resolved to the restricted VIP using restricted.googleapis.com. This endpoint denies access to Google APIs and services that are not supported by VPC Service Controls; private.googleapis.com does not provide that restriction.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!