nerdexam
Google

PROFESSIONAL-CLOUD-SECURITY-ENGINEER · Question #299

Your organization operates a hybrid cloud environment and has recently deployed a private Artifact Registry repository in Google Cloud. On-premises developers cannot resolve the Artifact Registry…

The correct answer is A. On-premises DNS servers lack the necessary records to resolve private Google API domains. The likely cause is that on-premises DNS servers cannot resolve private Google API domains; the fix is to create a Cloud DNS private zone and configure DNS forwarding from on-premises to Cloud DNS.

Submitted by kwame.gh· Apr 18, 2026Configuring access within a cloud solution environment

Question

Your organization operates a hybrid cloud environment and has recently deployed a private Artifact Registry repository in Google Cloud. On-premises developers cannot resolve the Artifact Registry hostname and therefore cannot push or pull artifacts. You've verified the following: - Connectivity to Google Cloud is established by Cloud VPN or Cloud Interconnect. - No custom DNS configurations exist on-premises. - There is no route to the internet from the on-premises network. You need to identify the cause and enable the developers to push and pull artifacts. What is likely causing the issue and what should you do to fix the issue?

Options

  • AOn-premises DNS servers lack the necessary records to resolve private Google API domains.
  • BDevelopers must be granted the artifactregistry.writer IAM role. Grant the relevant developer
  • CPrivate Google Access is not enabled for the subnet hosting the Artifact Registry. Enable Private
  • DArtifact Registry requires external HTTP/HTTPS access. Create a new firewall rule allowing

How the community answered

(48 responses)
  • A
    69% (33)
  • B
    6% (3)
  • C
    17% (8)
  • D
    8% (4)

Why each option

The likely cause is that on-premises DNS servers cannot resolve private Google API domains; the fix is to create a Cloud DNS private zone and configure DNS forwarding from on-premises to Cloud DNS.

AOn-premises DNS servers lack the necessary records to resolve private Google API domains.Correct

On-premises developers without an internet route require private DNS resolution for Google Cloud services like Artifact Registry. Cloud DNS private zones, combined with inbound DNS forwarding, allow on-premises DNS servers to resolve private Google API domains over Cloud VPN/Interconnect, enabling access without public internet connectivity.

BDevelopers must be granted the artifactregistry.writer IAM role. Grant the relevant developer

IAM roles define authorization, not name resolution; the problem statement indicates a hostname resolution issue, which occurs before authorization checks.

CPrivate Google Access is not enabled for the subnet hosting the Artifact Registry. Enable Private

Private Google Access is enabled on VPC subnets for VMs to reach Google APIs privately, but the issue here is on-premises hostname resolution for Artifact Registry through a hybrid connection, not VM access.

DArtifact Registry requires external HTTP/HTTPS access. Create a new firewall rule allowing

Suggesting external HTTP/HTTPS access contradicts the problem statement that there is no route to the internet from the on-premises network and the goal is private access to a private registry.

Concept tested: Hybrid DNS resolution for private Google APIs

Source: https://cloud.google.com/vpc/docs/configure-private-google-access#hybrid

Topics

#DNS Resolution#Hybrid Cloud Networking#Artifact Registry#Google APIs Private Access

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice