You need to set up a Cloud Interconnect connection between your company's on-premises data center and VPC host network. You want to make sure that on-premises applications can only access Google…

Question

Options

• AEnable Private Google Access on the regional subnets and global dynamic routing mode.
• BCreate a CNAME to map *.googleapis.com to restricted.googleapis.com, and create A records for
• CUse private.googleapis.com to access Google APIs using a set of IP addresses only routable
• DUse restricted googleapis.com to access Google APIs using a set of IP addresses only routable

• A
  9% (5)
• B
  4% (2)
• C
  15% (8)
• D
  73% (40)

Explanation

The correct answer is D: use restricted.googleapis.com. Google provides two private API endpoint domains for on-premises-to-Google traffic over Cloud Interconnect: (1) private.googleapis.com (199.36.153.8/30) supports all Google APIs but does NOT restrict access to only VPC Service Controls-supported APIs, and (2) restricted.googleapis.com (199.36.153.4/30) only allows APIs that are covered by VPC Service Controls, directly satisfying the exfiltration-risk mitigation requirement. Both options route traffic over Cloud Interconnect rather than the public internet, but only restricted.googleapis.com enforces the VPC SC API scope boundary. Option C (private.googleapis.com) fails the requirement because it permits non-VPC-SC APIs, creating exfiltration risk. Options A and B describe partial configurations (subnet PGA and CNAME/A records) that are prerequisites but are incomplete answers on their own.

No community discussion yet for this question.