Private Google Access in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable Private Google Access on a subnet.

GCP

resource "google_compute_subnetwork" "example" {
  name          = "example-subnet"
  ip_cidr_range = "10.0.0.0/24"
  region        = "us-central1"
  network       = "[1]"
  private_ip_google_access = true
}

Drag options to blanks, or click blank then click option'

Adefault-vpc

Bdefault-network

Cdefault-net

Ddefault

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect network names like 'default-vpc' or 'default-network' which do not exist.

Forgetting to set private_ip_google_access to true.

The subnet must be attached to the correct VPC network. In GCP, the default VPC network is named default.

2fill in blank

medium

Complete the command to enable Private Google Access on an existing subnet.

GCP

gcloud compute networks subnets update example-subnet --region=us-central1 --[1]

Drag options to blanks, or click blank then click option'

Aenable-private-google-access

Bset-private-google-access

Cprivate-google-access

Denable-private-google

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect or incomplete flags like '--set-private-google-access'.

Omitting the region parameter.

The correct gcloud flag to enable Private Google Access is --enable-private-google-access.

3fill in blank

hard

Fix the error in the Terraform snippet to correctly enable Private Google Access.

GCP

resource "google_compute_subnetwork" "example" {
  name          = "example-subnet"
  ip_cidr_range = "10.0.0.0/24"
  region        = "us-central1"
  network       = "default"
  private_ip_google_access = [1]
}

Drag options to blanks, or click blank then click option'

A"true"

BTrue

Ctrue

D1

Attempts:

3 left

💡 Hint

Common Mistakes

Using quotes around true, making it a string.

Using capitalized True which is invalid in Terraform.

The value for private_ip_google_access must be the boolean true without quotes in Terraform.

4fill in blank

hard

Fill both blanks to create a firewall rule allowing Private Google Access traffic.

GCP

resource "google_compute_firewall" "private-google-access" {
  name    = "allow-private-google-access"
  network = "default"
  direction = "INGRESS"
  [1] = ["35.191.0.0/16", "130.211.0.0/22"]
  [2] = ["tcp:443"]
}

Drag options to blanks, or click blank then click option'

Asource_ranges

Bdestination_ranges

Callowed

Ddenied

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'destination_ranges' instead of 'source_ranges'.

Using 'denied' instead of 'allowed'.

The firewall rule must specify source_ranges for the IP ranges and allowed for the allowed protocols and ports.

5fill in blank

hard

Fill all three blanks to configure a subnet with Private Google Access and a route to Google APIs.

GCP

resource "google_compute_subnetwork" "example" {
  name                     = "example-subnet"
  ip_cidr_range            = "10.1.0.0/24"
  region                   = "us-east1"
  network                  = "default"
  private_ip_google_access = [1]
}

resource "google_compute_route" "to-google-apis" {
  name       = "route-to-google-apis"
  network    = "default"
  dest_range = [2]
  next_hop   = [3]
}

Drag options to blanks, or click blank then click option'

Atrue

B"199.36.153.4/30"

C"default-internet-gateway"

Dfalse

Attempts:

3 left

💡 Hint

Common Mistakes

Setting private_ip_google_access to false.

Using incorrect destination ranges.

Using an invalid next hop value.

Private Google Access is enabled with true. The destination range for Google APIs is 199.36.153.4/30. The next hop for the route is the default-internet-gateway.

Practice

1. What is the main purpose of Private Google Access in Google Cloud?

easy

A. Provide a VPN connection between Google Cloud and on-premises networks

B. Allow VMs with only private IPs to access Google APIs without using the public internet

C. Allow external users to access Google Cloud resources securely

D. Enable VMs to have public IP addresses automatically

Solution

1. Step 1: Understand Private Google Access purpose

   It allows virtual machines without public IP addresses to reach Google APIs and services securely.

2. Step 2: Compare options with this purpose

   Only Allow VMs with only private IPs to access Google APIs without using the public internet describes this feature correctly; others describe unrelated features.

3. Final Answer:

   Allow VMs with only private IPs to access Google APIs without using the public internet -> Option B

4. Quick Check:

   Private Google Access = Secure private VM API access [OK]

Hint: Private Google Access = private VM access to Google APIs [OK]

Common Mistakes:

• Confusing Private Google Access with VPN or public IP assignment
• Thinking it allows external user access
• Assuming it provides public IPs automatically

2. Which configuration enables Private Google Access on a subnet in Google Cloud?

easy

A. Set private_ip_google_access = false in the subnet settings

B. Enable firewall rule to allow all traffic

C. Assign a public IP to all VMs in the subnet

D. Set private_ip_google_access = true in the subnet settings

Solution

1. Step 1: Identify the correct subnet setting for Private Google Access

   The subnet must have private_ip_google_access set to true to enable this feature.

2. Step 2: Review options for correctness

   Only Set private_ip_google_access = true in the subnet settings correctly sets private_ip_google_access to true; others disable it or are unrelated.

3. Final Answer:

   Set private_ip_google_access = true in the subnet settings -> Option D

4. Quick Check:

   Enable private_ip_google_access = true [OK]

Hint: Enable private_ip_google_access = true on subnet [OK]

Common Mistakes:

• Setting private_ip_google_access to false
• Thinking public IPs are required
• Confusing firewall rules with Private Google Access

3. Given a VM in a subnet with private_ip_google_access = true and no public IP, what happens when it tries to reach https://storage.googleapis.com?

medium

A. The VM accesses the URL through Private Google Access without using the public internet

B. The VM accesses the URL only if a VPN is configured

C. The VM cannot reach the URL because it has no public IP

D. The VM must use a NAT gateway to reach the URL

Solution

1. Step 1: Understand Private Google Access behavior

   With private_ip_google_access enabled, VMs without public IPs can reach Google APIs like storage.googleapis.com privately.

2. Step 2: Analyze options based on this behavior

   The VM accesses the URL through Private Google Access without using the public internet correctly describes this private access; others incorrectly deny access or require VPN/NAT.

3. Final Answer:

   The VM accesses the URL through Private Google Access without using the public internet -> Option A

4. Quick Check:

   Private IP VM + private_ip_google_access = private API access [OK]

Hint: Private IP VM with private_ip_google_access can reach Google APIs [OK]

Common Mistakes:

• Assuming no access without public IP
• Thinking VPN or NAT is mandatory
• Confusing Private Google Access with general internet access

4. A subnet has private_ip_google_access set to false. A VM without a public IP in this subnet cannot reach Google APIs. What is the best fix?

medium

A. Create a firewall rule to allow all outbound traffic

B. Assign a public IP to the VM

C. Enable private_ip_google_access = true on the subnet

D. Configure a VPN to Google Cloud

Solution

1. Step 1: Identify cause of no access

   Private Google Access is disabled, so private IP VMs cannot reach Google APIs.

2. Step 2: Choose the best fix

   Enabling private_ip_google_access on the subnet allows private IP VMs to access Google APIs without public IPs.

3. Final Answer:

   Enable private_ip_google_access = true on the subnet -> Option C

4. Quick Check:

   Enable private_ip_google_access to fix private VM API access [OK]

Hint: Enable private_ip_google_access = true to fix private VM API access [OK]

Common Mistakes:

• Assigning public IPs unnecessarily
• Adding firewall rules that don't affect Private Google Access
• Thinking VPN is required for Google API access

5. You have two subnets: Subnet A with private_ip_google_access = true and Subnet B with it set to false. A VM in Subnet B without a public IP needs to access Google APIs securely. What is the best approach?

hard

A. Move the VM to Subnet A or enable private_ip_google_access on Subnet B

B. Assign a public IP to the VM in Subnet B

C. Set up a NAT gateway for Subnet B

D. Create a firewall rule allowing access to Google APIs

Solution

1. Step 1: Understand subnet settings impact

   Private Google Access must be enabled on the subnet for private IP VMs to reach Google APIs.

2. Step 2: Evaluate options for secure access

   Moving the VM to Subnet A or enabling private_ip_google_access on Subnet B ensures secure private access without public IPs.

3. Step 3: Consider security and best practice

   Assigning public IPs or NAT gateways exposes the VM to public internet, less secure than Private Google Access.

4. Final Answer:

   Move the VM to Subnet A or enable private_ip_google_access on Subnet B -> Option A

5. Quick Check:

   Enable private_ip_google_access or move VM for secure private API access [OK]

Hint: Enable private_ip_google_access or move VM to subnet with it enabled [OK]

Common Mistakes:

• Assigning public IPs unnecessarily
• Relying on firewall rules alone
• Ignoring subnet configuration for Private Google Access