Your company has recently installed a Cloud VPN tunnel between your on-premises data center and your Google Cloud Virtual Private Cloud (VPC). You need to configure access to the Cloud Functions API f

Question

Options

• ACreate an A record for private.googleapis.com using the 199.36.153.8/30 address range.
• BCreate an A record for restricted.googleapis.com using the 199.36.153.4/30 address range.
• CCreate an A record for restricted.googleapis.com using the 199.36.153.4/30 address range.
• DCreate an A record for private.googleapis.com using the 199.36.153.8/30 address range.

• A
  4% (1)
• B
  81% (21)
• C
  4% (1)
• D
  12% (3)

Explanation

The requirements specify: no data exfiltration (VPC Service Controls), no internet routing (private access via RFC 1918 addresses), on-premises DNS, and access only to VPC Service Controls-compatible APIs. There are two virtual IP ranges for Private Google Access: private.googleapis.com (199.36.153.8/30), which allows all Google APIs, and restricted.googleapis.com (199.36.153.4/30), which strictly limits access to APIs that support VPC Service Controls. Because the requirement explicitly states 'only provide access to APIs that are compatible with VPC Service Controls,' restricted.googleapis.com with its 199.36.153.4/30 range is the correct choice. Using private.googleapis.com would allow APIs that are not VPC SC-compatible, violating the data exfiltration requirement. Since DNS must be resolved on-premises, the A record is created in the on-premises DNS system pointing to the restricted range.

No community discussion yet for this question.