PCNE Configuring Network Services Practice Question

Which THREE actions should you take to secure a VPC that hosts public-facing web applications?

⚠ Common exam trap

Google Cloud often tests the misconception that VPC Flow Logs are a security control that can block traffic, when in reality they are only a logging and monitoring feature, not an enforcement mechanism.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use Cloud NAT to allow outbound internet access without public IPs

Cloud NAT enables outbound internet access for private VMs without assigning them public IP addresses, which reduces the attack surface. This is a secure alternative to direct internet access because it allows outbound connections initiated by the VMs while blocking unsolicited inbound traffic from the internet. It works by translating private IP addresses to a set of ephemeral public IPs managed by Google Cloud.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Assign public IP addresses to all VMs for direct internet access
Why it's wrong here
Increases attack surface.
✓
Use Cloud NAT to allow outbound internet access without public IPs
Why this is correct
Provides outbound connectivity without exposing VMs.
✗
Enable VPC Flow Logs to block malicious traffic
Why it's wrong here
Flow Logs are for logging, not blocking.
✓
Enable Cloud Armor to protect against DDoS and application attacks
Why this is correct
Cloud Armor provides security policies.
✓
Use Private Google Access for VMs that need to access Google APIs
Why this is correct
Keeps traffic within Google network.

Visual reference

Go deeper

PCNE Configuring Network Services Practice Question

Why each option matters

Option-by-option breakdown

Related to this question