Crucial Exams

GCP Professional Cloud Security Engineer Practice Question

Your company operates two private subnets in the us-central1 region that host auto-scaling managed instance groups (MIGs). None of the VMs have external IP addresses, but they must periodically connect to a third-party SaaS platform that only accepts traffic from allow-listed public IP addresses. The security team insists that the set of egress IP addresses remain stable, while the network team wants Cloud NAT to handle sudden bursts of outbound connections without manual intervention for port management. Which Cloud NAT configuration best meets these requirements?

  • Assign individual static external IP addresses to every VM in the MIGs and enable Private Google Access instead of Cloud NAT.

  • Deploy separate zonal Cloud NAT gateways for each subnet with automatic address allocation and update the SaaS allow-list whenever Cloud NAT adds new addresses.

  • Create a single regional Cloud NAT gateway, reserve a small set of static external IP addresses, configure the gateway for manual address allocation with those reserved addresses, and retain the default automatic port allocation to scale during traffic spikes.

  • Create a regional Cloud NAT gateway that uses automatic address allocation so it can add additional external IPs when port demand increases.

GCP Professional Cloud Security Engineer
Securing communications and establishing boundary protection
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot