Your organization's Google Cloud VMs are deployed via an instance template that configures them with a public IP address in order to host web services for external users. The VMs reside in a service…

Question

Options

• ADeploy a Cloud NAT Gateway in the service project for the MIG.
• BDeploy a Cloud NAT Gateway in the host (VPC) project for the MIG.
• CDeploy an external HTTP(S) load balancer in the service project with the MIG as a backend.
• DDeploy an external HTTP(S) load balancer in the host (VPC) project with the MIG as a backend.

• A
  4% (1)
• B
  7% (2)
• C
  78% (21)
• D
  11% (3)

Explanation

Removing public IP addresses from VMs eliminates direct internet exposure but also removes their ability to receive inbound traffic. To continue serving external users, you need an external HTTP(S) load balancer, which acts as the single public-facing endpoint and proxies requests to the backend VMs over private IPs. In a Shared VPC topology, the load balancer is deployed in the service project (where the MIG lives), not the host project. Options A and B (Cloud NAT) are incorrect because NAT only handles outbound connections initiated by VMs - it does not enable inbound connections from external users. Option D is incorrect because load balancer frontends are managed in the service project, not the host/VPC project.

No community discussion yet for this question.