Google Cloud Professional Cloud Security Engineer Practice Exam

What is one strategy to ensure that a Compute Engine instance cannot access the internet while processing data?

1. Assign a public IP address to the instance

2. Enable Private Google Access on the Compute Engine subnet

3. Use a VPN to connect to the internet

4. Disable Firewall rules entirely

The correct answer is: Enable Private Google Access on the Compute Engine subnet

The strategy to ensure that a Compute Engine instance cannot access the internet while processing data is to enable Private Google Access on the Compute Engine subnet. By enabling this feature, the instance can interact with Google Cloud services without requiring a public IP address, thereby preventing direct internet access. Private Google Access allows resources in a Virtual Private Cloud (VPC) to connect to Google services through the internal network. This means that the instance can still communicate with other Google Cloud services, such as Google Cloud Storage or BigQuery, while remaining isolated from the public internet. This level of configuration enhances security by reducing the attack surface and ensuring that sensitive data is processed without exposure to potential outside threats. In contrast, assigning a public IP address would allow the instance direct access to the internet, which contradicts the goal of restricting internet access. Using a VPN to connect to the internet would similarly create a pathway for internet access, and disabling firewall rules would leave the instance vulnerable without providing any specific controls to restrict internet access.