Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services. Which two settings must remain disabled to meet these…

The correct answer is A. Public IP C. Private Google Access. Two settings must remain disabled to completely isolate a Compute Engine instance from the internet and Google APIs/services: (A) Public IP - without a public IP, the instance cannot directly send or receive traffic from the internet; and (C) Private Google Access - when…

Submitted by rania.sa· Apr 18, 2026Configuring access within a cloud solution environment

Question

Your team needs to make sure that a Compute Engine instance does not have access to the internet or to any Google APIs or services. Which two settings must remain disabled to meet these requirements? (Choose two.)

Options

APublic IP
BIP Forwarding
CPrivate Google Access
DStatic routes
EIAM Network User Role

How the community answered

(15 responses)

A
80% (12)
B
7% (1)
E
13% (2)

Explanation

Two settings must remain disabled to completely isolate a Compute Engine instance from the internet and Google APIs/services: (A) Public IP - without a public IP, the instance cannot directly send or receive traffic from the internet; and (C) Private Google Access - when enabled, Private Google Access allows VM instances without public IPs to reach Google APIs and services (e.g., Cloud Storage, BigQuery) via Google's internal network. If PGA is enabled, the instance can still reach Google APIs even without a public IP, violating the requirement. IP Forwarding (B) controls packet routing behavior and does not by itself grant internet access. Static routes (D) and IAM Network User Role (E) do not directly grant internet or Google API access to the instance itself.

Topics

#Compute Engine Networking#Network Egress#Google API Access#Security Configuration

Community Discussion

No community discussion yet for this question.

Full PROFESSIONAL-CLOUD-SECURITY-ENGINEER Practice