You perform a security assessment on a customer architecture and discover that multiple VMs have public IP addresses. After providing a recommendation to remove the public IP addresses, you are told…

The correct answer is B. Cloud NAT. Cloud NAT (Network Address Translation) is the correct answer. The core problem is that VMs need outbound internet access (to reach external sites) but should not have individual public IP addresses. Cloud NAT allows VM instances with only private internal IP addresses to…

Submitted by chiamaka_o· Apr 18, 2026Configuring network security

Question

You perform a security assessment on a customer architecture and discover that multiple VMs have public IP addresses. After providing a recommendation to remove the public IP addresses, you are told those VMs need to communicate to external sites as part of the customer's typical operations. What should you recommend to reduce the need for public IP addresses in your customer's VMs?

Options

AGoogle Cloud Armor
BCloud NAT
CCloud Router
DCloud VPN

How the community answered

(30 responses)

A
3% (1)
B
73% (22)
C
7% (2)
D
17% (5)

Explanation

Cloud NAT (Network Address Translation) is the correct answer. The core problem is that VMs need outbound internet access (to reach external sites) but should not have individual public IP addresses. Cloud NAT allows VM instances with only private internal IP addresses to initiate outbound connections to the internet. The NAT gateway holds the public IP instead of the individual VMs, drastically reducing the public IP attack surface. Google Cloud Armor (A) is a WAF/DDoS protection service, not an outbound routing solution. Cloud Router (C) enables dynamic routing with BGP but does not perform NAT for internet access. Cloud VPN (D) creates encrypted tunnels to on-premises or other clouds, which does not address the internet-access use case here.

Topics

#Cloud NAT#Outbound internet access#Private IP addresses#Network security

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice