Google Cloud Professional Cloud Security Engineer — Question 48

Your team wants to make sure Compute Engine instances running in your production project do not have public IP addresses. The frontend application Compute
Engine instances will require public IPs. The product engineers have the Editor role to modify resources. Your team wants to enforce this requirement.
How should your team meet these requirements?

Answer options

• A. Enable Private Access on the VPC network in the production project.
• B. Remove the Editor role and grant the Compute Admin IAM role to the engineers.
• C. Set up an organization policy to only permit public IPs for the front-end Compute Engine instances.
• D. Set up a VPC network with two subnets: one with public IPs and one without public IPs.

Correct answer: C

Explanation

The correct answer is C, as it directly establishes a policy that restricts public IP usage only to the frontend instances, fulfilling the requirement. Option A does not address the need for public IPs specifically for the frontend. Option B removes necessary permissions for the engineers, which is not the solution. Option D does not enforce the public IP restriction effectively across the instances.