Implementing VPC Instances practice questions

Assign a static external IP to each instance and configure a firewall rule to allow egress.

Why wrong: The requirement specifies instances have only internal IPs, so assigning external IPs is not desired.

Configure Private Google Access on the subnet to route traffic to Google APIs.

Why wrong: Private Google Access only allows access to Google APIs, not general internet.

Deploy a Compute Engine instance as a NAT instance with IP forwarding enabled.

Why wrong: A custom NAT instance is possible but not the recommended solution; Cloud NAT is the managed service.

Create VPC firewall rules with deny egress for the specific VMs in each VPC.

Why wrong: VPC-level rules can be overridden by higher-priority rules and are not centrally managed across projects.

Use a network firewall policy attached to each VPC network.

Why wrong: Network firewall policies apply per VPC and may not override VPC rules if not configured correctly, and they are not centralized at the org level.

Configure Cloud Armor security policies on the load balancer to block egress.

Why wrong: Cloud Armor policies apply to incoming traffic to load balancers, not egress from instances.

Private Service Connect and VPC Service Controls

Why wrong: Private Service Connect is for privately accessing specific services via endpoints, not for general Google API access.

Cloud NAT and VPC Service Controls

Why wrong: Cloud NAT provides internet access but doesn't restrict access to Google APIs; VPC Service Controls can restrict access but requires Private Google Access for VMs without external IPs.

Cloud NAT and Private Google Access

Why wrong: This combination allows outbound internet and Google API access but does not restrict other VPCs from accessing APIs.

Egress rule: source 0.0.0.0/0, target tag "web-server", tcp:80

Why wrong: Egress rules control outbound traffic; ingress is needed for incoming connections.

Egress rule: destination 0.0.0.0/0, target tag "web-server", tcp:80

Why wrong: This would allow outbound traffic from instances, not inbound HTTP.

Ingress rule: source 0.0.0.0/0, target service account "web-server", tcp:80

Why wrong: Tags are used, not service accounts, to target instances.

Configure Private Google Access on the subnet.

Why wrong: Private Google Access only allows access to Google APIs, not general internet.

Create a VPC firewall rule to allow egress to 0.0.0.0/0.

Why wrong: A firewall rule alone does not provide internet access without an external IP or NAT.

Assign a static external IP to the instance.

Why wrong: The requirement is to not have external IPs on the instance.

Yes, because VPC firewall rules override hierarchical policies for the same traffic.

Why wrong: Hierarchical policies have higher precedence.

Yes, because the VPC rule has a higher priority number and is more specific.

Why wrong: In GCP firewall evaluation, lower priority numbers are evaluated first. The hierarchical policy is evaluated before VPC rules.

No, because both rules deny and allow cancel out, resulting in default deny.

Why wrong: The deny from hierarchical policy wins.

Target service accounts

Why wrong: Target service accounts are for specifying the destination instances.

Source IP ranges

Why wrong: Source IP ranges are used for IP-based sources, not service accounts.

Source tags

Why wrong: Tags are used for instance-based targeting, not service accounts.

9000

Why wrong: 9000 is jumbo frames, but not default.

1400

Why wrong: 1400 is not the default.

1500

Why wrong: 1500 is the standard Ethernet MTU but not the default in GCP.

VPC peering

Why wrong: VPC peering requires direct peering between VPCs.

Cloud VPN

Why wrong: VPN is for hybrid connectivity, not service publishing.

Cloud NAT

Why wrong: NAT provides outbound internet, not inbound service publishing.

VPC Service Controls

Why wrong: VPC Service Controls restrict API access, not web application attacks.

Cloud Firewall Rules

Why wrong: Firewall rules operate at layer 3/4, not application layer.

Cloud CDN

Why wrong: Cloud CDN is for content caching, not WAF.

web-1.us-central1.c.my-project.internal

Why wrong: Zone must be included, not just region.

web-1.c.my-project.us-central1-a.internal

Why wrong: Incorrect order.

web-1.us-central1-a.my-project.internal

Why wrong: Missing the 'c' label.

The interface configured first in the instance creation.

Why wrong: That is nic0.

The interface with the highest index number.

Why wrong: Highest index is not primary.

All interfaces are primary.

Why wrong: Only nic0 is primary.

Cloud VPN

Why wrong: Used for hybrid connectivity, not API access control.

Cloud NAT

Why wrong: Provides internet access, not restriction.

Firewall rules

Why wrong: Firewall rules cannot restrict API access at the application layer.

Cloud VPN

Why wrong: Not needed for outbound internet.

VPC Flow Logs

Why wrong: VPC Flow Logs capture network flows but not specifically NAT logs; NAT logging is separate.

Use source service accounts on the health checkers.

Why wrong: Health checkers are Google infrastructure, not associated with a service account.

Use source tags on the health checkers.

Why wrong: Health checkers do not have tags; they are defined by IP ranges.

Use instance names in the firewall rule.

Why wrong: Firewall rules do not support instance names as targets.

Set up a Squid proxy on a bastion host with an external IP and route all API traffic through it.

Why wrong: This is complex and unnecessary; Private Google Access is designed for this scenario.

Create a Cloud NAT gateway in the same region and attach it to the VPC.

Why wrong: Cloud NAT is used for outbound internet access, not specifically for Google API access without external IPs. Private Google Access is the correct method.

Assign external IPs to the instances and create firewall rules to allow traffic to Google APIs.

Why wrong: This defeats the requirement of not having external IPs and may introduce security risks.

Assign a unique service account to the instances and use IAM conditions to allow the service account access to the bucket only when connecting from the VPC network.

Why wrong: IAM conditions can check the source IP, but with Private Google Access, the source IP is internal, so this is less effective.

Configure a firewall rule that allows egress traffic to the Cloud Storage API only from the instances' subnet.

Why wrong: Firewall rules control network traffic but do not enforce access control on the API itself.

Create an IAM condition that restricts access based on the instance's internal IP address range.

Why wrong: Internal IPs can be spoofed or changed; IAM conditions are not the strongest mechanism for network-level restrictions.

VPC Service Controls

Why wrong: VPC Service Controls manage data exfiltration risks, not application-layer attacks.

Firewall Rules

Why wrong: Firewall rules operate at Layer 3/4 and cannot inspect application payloads.

Cloud NAT

Why wrong: Cloud NAT provides outbound internet access, not security.

Use Cloud VPN to connect each consumer VPC to the central VPC.

Why wrong: VPN adds complexity and bandwidth limitations.

Expose the service through an external IP and use IAM to restrict access.

Why wrong: This goes against the requirement of using private IPs.

Set up VPC peering between each consumer VPC and the central VPC.

Why wrong: VPC peering works but requires transitive peering limitations and management of many peerings.

Cloud NAT is not configured in the correct region.

Why wrong: The NAT gateway must be in the same region as the instances. The scenario mentions us-central1, which should be fine.

Private Google Access is enabled on the subnet, which overrides Cloud NAT.

Why wrong: Private Google Access does not affect general internet access via NAT.

The Cloud NAT router is not attached to the correct VPC network.

Why wrong: If it were not attached, NAT wouldn't work at all. The issue is likely firewall-related.