Question

A financial services company runs a fleet of backend processing VMs in a private subnet within a Shared VPC. Organization policy prohibits assigning external IP addresses to these VMs. However, the VMs must periodically download OS security patches and pull dependencies from public package repositories on the internet. Inbound connections from the internet to these VMs must remain impossible. What should the security engineer configure to meet these requirements?

Accepted Answer

Deploy Cloud NAT for the subnet's region and configure it to provide outbound-only internet access for the private VMs

Answer

Assign ephemeral external IP addresses to the VMs and create an egress firewall rule allowing traffic to package repositories

Answer

Create a Private Service Connect endpoint that forwards VM traffic to public package repositories

Answer

Configure Cloud VPN to route VM internet-bound traffic through an on-premises proxy with a public IP