Allow VPC Instances Access to BigQuery and Cloud Pub/Sub APIs without Firewall - PCNE Exam Answer

Allow VPC Instances Access to BigQuery and Cloud Pub/Sub APIs without Firewall

Q: You are using a third-party next-generation firewall to inspect traffic.You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall.You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.Which two actions should you take? (Choose two.)

Turn on Private Services Access at the VPC level.Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.

Prev Question Next Question

Question

You are using a third-party next-generation firewall to inspect traffic.

You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall.

You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.

Which two actions should you take? (Choose two.)

Answers

A. Turn on Private Google Access at the subnet level.

B. Turn on Private Google Access at the VPC level.

C. Turn on Private Services Access at the VPC level.

D. Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.

E. Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.

Show Answer

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D. E.

CE.

https://cloud.google.com/vpc/docs/private-access-options

The goal is to allow VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs without sending the traffic through the third-party firewall.

Option A: Turning on Private Google Access at the subnet level allows VMs in the subnet to use private IP addresses to reach Google APIs and services. This is achieved by routing requests to the private IP address range used by the respective Google service through a private connection, rather than through the internet. This option alone does not provide a solution to the problem because Private Google Access does not support all Google APIs, and it does not provide a way to bypass the firewall for specific APIs.

Option B: Turning on Private Google Access at the VPC level enables Private Google Access across all subnets in the VPC. This option alone does not provide a solution to the problem because Private Google Access does not support all Google APIs, and it does not provide a way to bypass the firewall for specific APIs.

Option C: Turning on Private Services Access at the VPC level enables VMs in the VPC to reach services hosted on-premises or outside of Google Cloud via private IP addresses. This option is not relevant to the problem at hand because it does not address access to Google APIs and services.

Option D: Creating a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway would bypass the firewall. However, it is not recommended because external IP addresses can change, and managing multiple static routes can become cumbersome.

Option E: Creating a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway is the recommended solution. This option allows traffic to bypass the firewall because it routes traffic directly to the Google APIs and services without going through the firewall. The internal IP addresses of Google APIs and services are stable, making this option easy to manage.

Therefore, the correct options are A and E. Turning on Private Google Access at the subnet level and creating custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway will allow VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs without sending traffic through the third-party firewall.

Prev Question Next Question