Question

A financial services company runs multiple workloads in Google Cloud across several VPCs. Security policy mandates that all outbound internet-bound traffic from these workloads must be centrally inspected by a next-generation firewall for logging, threat prevention, and URL filtering before leaving the cloud. The design team wants to avoid each VPC egressing directly to the internet. Which connectivity/security design best meets this backhaul internet traffic requirement?

Accepted Answer

Route all workload VPC egress through a centralized hub VPC hosting NGFW appliances, then out to the internet after inspection

Answer

Deploy Cloud NAT in every VPC so each workload can reach the internet directly with source NAT

Answer

Enable Private Google Access on each subnet so traffic stays on Google's backbone

Answer

Assign external IP addresses to each VM and apply hierarchical firewall policies at the organization level