Google Professional Cloud Network Engineer

Get started today

Ultimate access to all questions.

Quick Answer

Answer-first summary for fast verification

Answer: 1. Delete the default route in your VPC and configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP). 2. Create a private Cloud DNS zone for googleapis.com, create a CNAME for * googieapis.com to Private googleapis.com, and create an A record for private.googleapis.com that resolves to the addresses in 199.36.153.8/30. 3. Create a static route in your VPC for the range 199.36.153.8/30 with the default internet gateway as the next hop.

To enable Private Google Access for VM instances with private IP addresses to access Google APIs while routing other traffic back to the on-premises data center via Cloud Interconnect, the correct approach involves deleting the default route in the VPC to prevent non-Google API traffic from using the internet gateway. Instead, this traffic should be routed through the on-premises connection by advertising 0.0.0.0/0 via BGP from the on-premises router. For Google API traffic, a private Cloud DNS zone for googleapis.com must be created with a CNAME record pointing *.googleapis.com to private.googleapis.com and an A record for private.googleapis.com resolving to 199.36.153.8/30. Additionally, a static route in the VPC for 199.36.153.8/30 with the default internet gateway as the next hop ensures that Google API traffic remains within Google's network. Option D correctly outlines these steps, making it the correct choice. Other options either misconfigure DNS or fail to properly route traffic, leading to potential access issues or traffic not being scrubbed as required.

Author: LeetQuiz Editorial Team

Quick Answer

Answer-first summary for fast verification

Author: LeetQuiz Editorial Team

Comments (0)

No comments yet.

You need to configure Private Google Access for VM instances in your VPC to access Google APIs while ensuring all other VM traffic routes back to your on-premises data center via Cloud Interconnect for scrubbing. The VMs have only private IPs and must access Cloud Storage. How should you set this up so that traffic to Google APIs stays within the VPC while other traffic is routed on-premises?

Exam-Like

Last updated: February 13, 2026 at 14:03

Delete the default route in your VPC. 2. Create a private Cloud DNS zone for googleapis.com, create a CNAME for *.googleapis.com to restricted googleapis.com, and create an A record for restricted googleapis com that resolves to the addresses in 199.36.153.4/30. 3. Create a static route in your VPC for the range 199.36.153.4/30 with the default internet gateway as the next hop.

6.3%

Delete the default route in your VPC and configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP). 2. Create a public Cloud DNS zone with a CNAME for *.google.com to private googleapis com, create a CNAME for * googleapis.com to private googleapis com, and create an A record for Private googleapis.com that resolves to the addresses in 199.36.153 8/30. 3. Create a static route in your VPC for the range 199 .36.153.8/30 with the default internet gateway as the next hop.

18.8%

Configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP) with a lower priority (MED) than the default VPC route. 2. Create a private Cloud DNS zone for googleapis.com, create a CNAME for * googieapis.com to private googleapis com, and create an A record for private.googleapis.com that resolves to the addresses in 199 .36.153.8/30. 3. Create a static route in your VPC for the range 199.36. 153.8/30 with the default internet gateway as the next hop.

18.8%

Delete the default route in your VPC and configure your on-premises router to advertise 0.0.0.0/0 via Border Gateway Protocol (BGP). 2. Create a private Cloud DNS zone for googleapis.com, create a CNAME for * googieapis.com to Private googleapis.com, and create an A record for private.googleapis.com that resolves to the addresses in 199.36.153.8/30. 3. Create a static route in your VPC for the range 199.36.153.8/30 with the default internet gateway as the next hop.

56.3%