Task 3.3: Managing networking resources.

• AA Cloud NAT gateway on a Cloud Router in the subnet's region

  Incorrect

  Cloud NAT provides outbound internet access, which security removed on purpose, and traffic to Google APIs is handled by Private Google Access rather than by NAT.

• BA custom static route for 199.36.153.8/30 with the default internet gateway as next hop

  Correct

  Private Google Access needs routes to the Google API ranges whose next hop is the default internet gateway; a specific route replaces the deleted default route for this range only.

• CAn ingress firewall rule allowing TCP 443 from 199.36.153.8/30 to the VMs

  Incorrect

  Firewall rules are stateful, so replies to the VMs' requests are already allowed; what is missing is a route for the outgoing requests.

• DA custom static route for 199.36.153.8/30 with one of the subnet's VMs as next hop

  Incorrect

  Traffic to Google APIs cannot be routed through other VM instances or custom next hops; the route's next hop must be the default internet gateway.

A custom static route can be narrower than the default route. Here it sends only the private.googleapis.com range to the default internet gateway, so Google APIs work while the rest of the internet stays unreachable.

• AA Cloud NAT gateway on a Cloud Router for the subnet's region

  Correct

  Cloud NAT lets VMs without external IPs open outbound connections to the internet, while unsolicited inbound connections are not allowed.

• BAn ephemeral external IP address on each VM

  Incorrect

  External IPs would make the VMs reachable from the internet, which is not allowed.

• CPrivate Google Access on the subnet

  Incorrect

  Private Google Access reaches Google APIs and services, not public package mirrors elsewhere on the internet.

• DAn egress firewall rule allowing TCP 80 and 443 to 0.0.0.0/0

  Incorrect

  Egress is already allowed by the implied rule; the missing piece is a public source address for the traffic, which NAT provides.

Firewall rules decide what is allowed; addressing decides what is reachable. Cloud NAT gives private VMs outbound internet access without giving them public addresses.

• AReserve a new static external IP address and assign it to the VM

  Incorrect

  A new reservation gets a different address, so the partner's allowlist would no longer match.

• BConfigure Cloud NAT with the VM's current address as the NAT IP

  Incorrect

  Cloud NAT uses addresses reserved for NAT and serves VMs without external IPs; it cannot keep an ephemeral VM address.

• CEnable deletion protection on the VM so that it keeps its address

  Incorrect

  Deletion protection blocks deleting the VM; stopping it still releases an ephemeral address.

• DPromote the ephemeral external IP address to a static address

  Correct

  Promoting reserves the address the VM already uses, so it stays in the project until you release it.

Ephemeral external addresses can change when a VM stops. If one must be kept, promote it to static in place rather than reserving another one.

• ACloud Asset Inventory export of the rules to BigQuery

  Incorrect

  An export lists the rules; it does not convert them.

• BRaising every rule's priority to 1

  Incorrect

  Priorities do not move rules into a policy.

• CThe VPC firewall rules migration tool in the gcloud CLI

  Correct

  The tool creates a global network firewall policy and converts the existing rules, keeping their relative order.

• DA script that deletes all rules and asks teams to recreate them

  Incorrect

  Recreating 150 rules by hand is slow and error-prone.

Network firewall policies add capabilities that VPC firewall rules lack, and the migration tool converts existing rules into one.

• ADNSSEC on the public zone, plus a DS record

  Correct

  DNSSEC authenticates DNS responses; the registrar's DS record completes the chain of trust.

• BA private zone with the same records

  Incorrect

  Moving the records out of the public zone would break public resolution of the domain.

• CA shorter TTL on every record

  Incorrect

  TTLs control caching time, not response authenticity.

• DA firewall rule allowing only port 53

  Incorrect

  Cloud DNS public zones are not protected by VPC firewall rules.

DNSSEC protects the integrity of public DNS answers; it requires work at both the zone and the registrar.

• AA static external IP address for the instance

  Incorrect

  This is the public address the design wants to avoid.

• BPrivate services access with an allocated IP range

  Correct

  Cloud SQL private IP uses private services access, which needs an allocated range and a private connection.

• CA firewall rule allowing port 3306 from anywhere

  Incorrect

  Firewall rules do not create the private connection.

• DCloud NAT on the instance's region

  Incorrect

  This does not create a private connection to Cloud SQL.

Managed services such as Cloud SQL reach your VPC privately through private services access, which you set up once per network.

• AThe 10.20.0.0/16 route, because it has the lower priority number

  Incorrect

  Priority is considered only among routes with the same, most specific destination.

• BNeither, because the default internet route wins

  Incorrect

  The default route is the least specific and is used only when nothing more specific matches.

• CBoth routes, with traffic split between them

  Incorrect

  Traffic is not split across routes with different prefixes.

• DThe 10.20.5.0/24 route, because it is the most specific match

  Correct

  Routing picks the most specific destination first; priority only breaks ties between equally specific routes.

Route selection checks specificity before priority, which is why a narrow route can override a broad one regardless of priority.

• Adefault-allow-ssh and default-allow-rdp

  Correct

  These pre-populated rules allow SSH and RDP from any source.

• BThe implied allow egress rule of the network

  Incorrect

  Egress rules do not open inbound SSH or RDP.

• Cdefault-allow-internal in the default network

  Incorrect

  This rule allows traffic between instances inside the network, not from the internet.

• DThe implied deny ingress rule of the network

  Incorrect

  This rule blocks unmatched inbound traffic; removing it is not possible and would not help.

The default network is convenient but permissive. Review its pre-populated rules before using it for anything real.