exam questions

Exam Associate Cloud Engineer All Questions

View all questions & answers for the Associate Cloud Engineer exam

Exam Associate Cloud Engineer topic 1 question 63 discussion

Actual exam question from Google's Associate Cloud Engineer
Question #: 63
Topic #: 1
[All Associate Cloud Engineer Questions]

You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?

  • A. 1. Use nslookup to get the IP address for storage.googleapis.com. 2. Negotiate with the security team to be able to give a public IP address to the servers. 3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com.
  • B. 1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud. 2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance. 3. Configure your servers to use that instance as a proxy to access Cloud Storage.
  • C. 1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine. 2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend. 3. Configure your new instances to use this ILB as proxy.
  • D. 1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in Google Cloud. 2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel. 3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com.
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
poogcp
Highly Voted 4 years, 2 months ago
D is the correct one as per Ref: https://cloud.google.com/vpc/docs/configure-private-google-access-hybrid
upvoted 55 times
...
obeythefist
Highly Voted 2 years, 6 months ago
What messy answers! I chose D and here is my reasoning per answer. A. It's bad practice to use nslookup to try find a permanent IP address because IPs can change. That's what DNS is for! Also, the security team aren't going to budge... this is just a silly answer. B. We're getting warmer. Any time a question mentions on-prem and cloud, Google wants you to think about Cloud VPN. This solution might even work, but installing Squid? This is a messy solution to a more simple problem. C. Talk about using a sledge hammer to swat a mosquito. I think this could work, but migrating servers to cloud to solve a simple networking problem? D. Once more Google's favorite Cloud VPN is in the answer. I'm not sure about the networking component of this question.
upvoted 26 times
obeythefist
2 years, 6 months ago
Edit: Of course the reason D: is correct is because 199.36.153.4/30 is the network segment that you can direct traffic to if you want to use Google services "internally". So your on prem servers will resolve storage.googleapis.com to something in this 199.36.153.4/30 range. Then they will route using Cloud Router and your VPN tunnel into Google Cloud privately.
upvoted 15 times
...
...
Cloudmoh
Most Recent 2 weeks, 6 days ago
Selected Answer: D
Well D is the right option : . Using Cloud VPN or Interconnect, create a tunnel to a VPC in Google Cloud. 2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel. 3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com
upvoted 1 times
...
subha.elumalai
3 months, 1 week ago
C is the correct Answer
upvoted 1 times
...
BAofBK
10 months ago
The correct answer is D
upvoted 2 times
...
gsmasad
10 months, 1 week ago
Selected Answer: D
D as per google recommened pratcises
upvoted 1 times
...
Captain1212
1 year ago
Selected Answer: D
D as per google recommened pratcises
upvoted 1 times
...
Buruguduystunstugudunstuy
1 year, 6 months ago
Selected Answer: D
ANSWER D is the recommended solution because it provides a secure and direct connection to Cloud Storage without requiring internet access or exposing the servers to public IP addresses. * By setting up a VPN or Interconnect tunnel, the on-premises servers can access Google Cloud resources over a private and encrypted connection. * The custom route advertisement for 199.36.153.4/30 ensures that traffic is routed correctly between the on-premises network and Google Cloud. * Configuring the DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com ensures that requests are directed to Google Cloud over the VPN or Interconnect tunnel.
upvoted 9 times
...
warrior9000
1 year, 8 months ago
D but anyone wanna try to explain how the hell you can have a VPN connection without accessing the public internet? The only option for D should be using Interconnect for a direct private wire from your data center to GCP. VPN doesn't make any sense.
upvoted 6 times
xaqanik
1 year, 8 months ago
https://cloud.google.com/vpc/docs/configure-private-google-access-hybrid
upvoted 3 times
...
ast3citos
1 year, 5 months ago
The machine hosting the application cannot access directly the public internet. So to go to Google Cloud it must go through a VPN.
upvoted 1 times
...
...
cslince
1 year, 9 months ago
Selected Answer: D
D is the correct
upvoted 1 times
...
gcpBeginner
1 year, 11 months ago
correct answer is D. why will cx migrate it env. to GCP. easiest and faster approach is to have Cloud VPN setup and advertise route o cloud router
upvoted 1 times
gcpBeginner
1 year, 11 months ago
in my above comment I meant advertise routes to local router used on-prem
upvoted 1 times
...
...
Cornholio_LMC
1 year, 11 months ago
had this question today
upvoted 3 times
...
RAVI321
2 years ago
how you all know that everybody mere to upar se nikal raha hai sab kuch pls help guys
upvoted 5 times
Souvik_79
1 year, 10 months ago
Me too bro
upvoted 1 times
...
aakash4Chaudhary
1 year, 11 months ago
tu akela nhi hai bro
upvoted 2 times
...
...
abirroy
2 years ago
Selected Answer: D
Answer is D
upvoted 1 times
...
RanjithK
2 years, 2 months ago
Selected Answer: D
Answer is D
upvoted 1 times
...
AzureDP900
2 years, 2 months ago
D is most appropriate, This is part of Tutorial Dojo practice questions.
upvoted 1 times
...
haroldbenites
2 years, 3 months ago
Go for D
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago