nerdexam
Google

PROFESSIONAL-CLOUD-ARCHITECT · Question #256

Case Study: 10 - EHR Healthcare Company overview EHR Healthcare is a leading provider of electronic health record software to the medical industry. EHR Healthcare provides their software as a service

The correct answer is A. Create an Organizational Policy with a constraint to allow external IP addresses only on the. Using an Organization Policy, you can restrict external IP addresses to specific VMs with constraints to control use of external IP addresses for your VM instances within an organization https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip- address#disabl

Submitted by daniela_cl· Mar 30, 2026Designing for security and compliance

Question

Case Study: 10 - EHR Healthcare Company overview EHR Healthcare is a leading provider of electronic health record software to the medical industry. EHR Healthcare provides their software as a service to multi-national medical offices, hospitals, and insurance providers. Solution concept Due to rapid changes in the healthcare and insurance industry, EHR Healthcare's business has been growing exponentially year over year. They need to be able to scale their environment, adapt their disaster recovery plan, and roll out new continuous deployment capabilities to update their software at a fast pace. Google Cloud has been chosen to replace their current colocation facilities. Existing technical environment EHR's software is currently hosted in multiple colocation facilities. The lease on one of the data centers is about to expire. Customer-facing applications are web-based, and many have recently been containerized to run on a group of Kubernetes clusters. Data is stored in a mixture of relational and NoSQL databases (MySQL, MS SQL Server, Redis, and MongoDB). EHR is hosting several legacy file- and API-based integrations with insurance providers on- premises. These systems are scheduled to be replaced over the next several years. There is no plan to upgrade or move these systems at the current time. Users are managed via Microsoft Active Directory. Monitoring is currently being done via various open source tools. Alerts are sent via email and are often ignored. Business requirements • On-board new insurance providers as quickly as possible. • Provide a minimum 99.9% availability for all customer-facing systems. • Provide centralized visibility and proactive action on system performance and usage. • Increase ability to provide insights into healthcare trends. • Reduce latency to all customers. • Maintain regulatory compliance. • Decrease infrastructure administration costs. • Make predictions and generate reports on industry trends based on provider data. Technical requirements • Maintain legacy interfaces to insurance providers with connectivity to both on-premises systems and cloud providers. • Provide a consistent way to manage customer-facing applications that are container-based. • Provide a secure and high-performance connection between on-premises systems and Google Cloud. • Provide consistent logging, log retention, monitoring, and alerting capabilities. • Maintain and manage multiple container-based environments. • Dynamically scale and provision new environments. • Create interfaces to ingest and process data from new providers. Executive statement Our on-premises strategy has worked for years but has required a major investment of time and money in training our team on distinctly different systems, managing similar but separate environments, and responding to outages. Many of these outages have been a result of misconfigured systems, inadequate capacity to manage spikes in traffic, and inconsistent monitoring practices. We want to use Google Cloud to leverage a scalable, resilient platform that can span multiple environments seamlessly and provide a consistent and stable user experience that positions us for future growth. For this question, refer to the EHR Healthcare case study. In the past, configuration errors put public IP addresses on backend servers that should not have been accessible from the Internet. You need to ensure that no one can put external IP addresses on backend Compute Engine instances and that external IP addresses can only be configured on frontend Compute Engine instances. What should you do?

Options

  • ACreate an Organizational Policy with a constraint to allow external IP addresses only on the
  • BRevoke the compute.networkAdmin role from all users in the project with front end instances.
  • CCreate an Identity and Access Management (IAM) policy that maps the IT staff to the
  • DCreate a custom Identity and Access Management (IAM) role named GCE_FRONTEND with the

How the community answered

(15 responses)
  • A
    73% (11)
  • B
    13% (2)
  • C
    7% (1)
  • D
    7% (1)

Explanation

Using an Organization Policy, you can restrict external IP addresses to specific VMs with constraints to control use of external IP addresses for your VM instances within an organization https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip- address#disableexternalip

Topics

#Organizational Policy#external IP restriction#compute.vmExternalIpAccess#resource hierarchy

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-ARCHITECT Practice