GCP Professional Cloud Security Engineer Practice Question

Your security team runs Linux VMs in two private subnets of the prod-vpc network in the us-central1 region. None of the instances have external IP addresses, yet they must regularly download security updates from public package repositories on the internet. An external software vendor also requires a single, stable source IP address (or very small, predictable set) to allowlist outbound traffic from this environment. The design must remain highly available across all zones in the region and demand minimal ongoing management. How should you configure egress so that you meet all requirements?

Reserve a regional static external address, create a single regional Cloud NAT gateway attached to a Cloud Router in us-central1, select both private subnets, and configure the gateway to use the reserved address with manual NAT IP allocation.
Create separate Cloud NAT gateways for each subnet using automatic NAT IP allocation so each VM uses the first available ephemeral external IP address.
Establish VPC Network Peering to a Google-managed project and assign external IP addresses to the Cloud Router to provide outbound connectivity.
Enable Private Google Access on the subnets and deploy an internal HTTP(S) load balancer with serverless NEGs to proxy outbound traffic to the internet.

Report Issue

Answer Description

A regional Cloud NAT gateway provides highly available egress for all subnets in every zone of the region because the service is fully distributed. When you reserve one or more regional static external addresses and configure the NAT gateway to use "manual" NAT IP allocation, every VM without an external IP in the selected subnets leaves the VPC through only those reserved addresses. This gives the vendor a single, predictable IP (or a small, fixed list) to allowlist and avoids per-instance public IPs. Creating separate gateways with automatically allocated addresses produces multiple, potentially changing egress IPs; Private Google Access secures only Google APIs, not arbitrary internet hosts; peering with another project does not provide NAT functionality. Therefore, reserving a static address and attaching it to a regional Cloud NAT that serves both subnets is the correct solution.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.