You have several VMs across multiple VPCs in your cloud environment, which require access to internet endpoints. These VMs cannot have public IP addresses due to security policies, so you plan to…

Question

Options

• ACreate a firewall rule in each VPC at priority 500 that targets all instances in the network and
• BCreate a constraints/compute.restrictCloudNATUsage organizational policy constraint. Attach the
• CCreate a firewall rule in each VPC at priority 500 that targets all instances in the network and
• DDeploy Cloud NAT in each VPC, and configure a custom source range that includes the allowed

• A
  6% (3)
• B
  4% (2)
• C
  13% (7)
• D
  77% (41)

Explanation

Cloud NAT with Custom Source Ranges: Cloud NAT allows you to configure a custom source range that limits which subnets can use it for outbound internet access. By specifying the allowed subnets only, you can ensure that no unauthorized subnet can unintentionally or maliciously use Cloud NAT for egress. Cloud NAT Rules for Subnet-Specific Control: Configuring rules in Cloud NAT allows fine-grained control over which subnets have access to the internet. This aligns with Google-recommended practices for securing internet access and avoiding configuration errors. Avoiding Unintentional Configuration Issues: By using Cloud NAT's built-in configuration options (custom source ranges and NAT rules), you eliminate the need for additional firewall rules or complex organizational policies, reducing the likelihood of misconfiguration by administrators.

No community discussion yet for this question.