Answer-first summary for fast verification
Answer: Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.
The question requires configuring Cloud Interconnect to ensure on-premises applications access Google APIs exclusively through the private connection, not the public internet, while restricting access to only VPC Service Controls-supported APIs to mitigate data exfiltration risks. Option D (using restricted.googleapis.com) is correct because it specifically routes API traffic through private IP addresses only accessible within Google Cloud via the Cloud Interconnect connection, and it blocks access to Google APIs and services that do not support VPC Service Controls, aligning with the security requirement. Option A is incorrect as Private Google Access on regional subnets does not enforce the VPC Service Controls restriction. Option B is flawed due to incorrect IP addressing (should be 199.36.153.4/30, not 8/30) and relies on DNS manipulation, which is less secure. Option C (private.googleapis.com) allows access to all Google APIs, including those not supported by VPC Service Controls, which violates the exfiltration mitigation requirement. The community discussion, with 100% consensus and upvoted comments, strongly supports D for its alignment with VPC Service Controls and secure routing.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
You need to configure a Cloud Interconnect connection between your on-premises data center and a Google Cloud VPC network. The requirement is to ensure on-premises applications access Google APIs exclusively through the Cloud Interconnect, not the public internet, and only use APIs supported by VPC Service Controls to mitigate data exfiltration risks. How should you design the network configuration?
A
Enable Private Google Access on the regional subnets and global dynamic routing mode.
B
Create a CNAME to map *.googleapis.com to restricted.googleapis.com, and create A records for restricted.googleapis.com mapped to 199.36.153.8/30.
C
Use private.googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the connection.
D
Use restricted googleapis.com to access Google APIs using a set of IP addresses only routable from within Google Cloud, which are advertised as routes over the Cloud Interconnect connection.