Google Cloud Professional Cloud Security Engineer — Question 336

Your organization operates a hybrid cloud environment and has recently deployed a private Artifact Registry repository in Google Cloud. On-premises developers cannot resolve the Artifact Registry hostname and therefore cannot push or pull artifacts. You've verified the following:

• Connectivity to Google Cloud is established by Cloud VPN or Cloud Interconnect.
• No custom DNS configurations exist on-premises.
• There is no route to the internet from the on-premises network.

You need to identify the cause and enable the developers to push and pull artifacts. What is likely causing the issue and what should you do to fix the issue?

Answer options

• A. On-premises DNS servers lack the necessary records to resolve private Google API domains. Create DNS records for restricted.googleapis.com or private.googleapis.com pointing to Google's published IP ranges.
• B. Developers must be granted the artifactregistry.writer IAM role. Grant the relevant developer group this role.
• C. Private Google Access is not enabled for the subnet hosting the Artifact Registry. Enable Private Google Access for the appropriate subnet.
• D. Artifact Registry requires external HTTP/HTTPS access. Create a new firewall rule allowing ingress traffic on ports 80 and 443 from the developer's IP ranges.

Correct answer: A

Explanation

The issue arises because on-premises DNS servers do not have the necessary records to resolve the private Google API domains. By creating the appropriate DNS records, the developers will be able to resolve the Artifact Registry hostname. The other options address different aspects of access and permissions but do not resolve the DNS resolution issue.