Your company has a single Virtual Private Cloud (VPC) network deployed in Google Cloud with access from your on-premises network using Cloud Interconnect. You must configure access only to Google…

Question

Options

• AConfigure the existing Cloud Routers to advertise the Google API's public virtual IP addresses.
• BUse Private Google Access for on-premises hosts with restricted.googleapis.com virtual IP
• CConfigure the existing Cloud Routers to advertise a default route, and use Cloud NAT to translate
• DAdd Direct Peering links, and use them for connectivity to Google APIs that use public virtual IP

• A
  4% (1)
• B
  81% (21)
• C
  4% (1)
• D
  12% (3)

Explanation

The restricted.googleapis.com virtual IP (VIP) range (199.36.153.4/30) is specifically designed for accessing only Google APIs that are supported and protected by VPC Service Controls. Using Private Google Access for on-premises hosts (B) routes API traffic from on-premises through the Cloud Interconnect into the VPC, then to Google APIs via the restricted VIP - ensuring only VPC Service Controls-compatible APIs are reachable and that no API traffic traverses the public internet. This configuration also inherits the SLA of the existing Dedicated Interconnect. Option A (advertising public VIPs via Cloud Router) would route traffic to the public googleapis.com range, bypassing VPC Service Controls boundaries. Option C (default route + Cloud NAT) uses NAT for outbound traffic and doesn't restrict to VPC Service Controls-supported APIs. Option D (Direct Peering) is a separate Google service with no SLA guarantee and doesn't enforce VPC Service Controls.

No community discussion yet for this question.