You are deploying a batch pipeline in Dataflow. This pipeline reads data from Cloud Storage, transforms the data, and then writes the data into BigQuery. The security team has enabled an…

Question

Options

• DEnsure that Private Google Access is enabled in the subnetwork. Use Dataflow with only internal IP addresses.

• D
  100% (39)

Explanation

Option D is correct because when an org policy blocks external IPs on Compute Engine (which Dataflow workers run on), you must configure Dataflow to use --usePublicIps=false (internal IPs only) - but workers still need to reach Google APIs like Cloud Storage and BigQuery. Private Google Access bridges this gap: it allows VMs without external IPs to reach Google APIs using internal routing over Google's network, satisfying both the security constraint and the pipeline's connectivity needs.

Why distractors are typically wrong in this scenario: Options suggesting you add external IPs violate the org policy outright. Options suggesting VPC peering or Cloud NAT are unnecessary overhead - Cloud NAT handles internet-bound traffic, not Google API access, and Private Google Access is the purpose-built, simpler solution for this exact problem.

Memory tip: Think of Private Google Access as a "back door to Google" - when your VMs have no external IP (front door), PGA lets them quietly reach *.googleapis.com through Google's internal network. The pairing is always: internal-only Dataflow workers + Private Google Access enabled on the subnet.

No community discussion yet for this question.