You need to restrict HA VPN tunnels in a project so they may only peer with on-premises IP 203.0.113.1/32. How do you enforce this at the project/organization level?
Choose an answer
Tap an option to check your answer.
Correct answer: Configure the Resource Manager constraint constraints/compute.restrictVpnPeerIPs to use an allowList consisting of only the 203.0.113.1/32 address..
Why this is the answer
The correct approach is to configure the Resource Manager constraint constraints/compute.restrictVpnPeerIPs. This organization policy constraint specifically controls the external IP addresses that HA VPN gateways can peer with. By setting an allowList with only 203.0.113.1/32, you enforce this restriction across the project or organization. Configuring a firewall rule is incorrect because firewall rules control traffic through the VPN tunnel, not the peering itself. Google Cloud Armor is designed for protecting external HTTP(S) load balancers and is not applicable to VPN peering. Configuring an access control list on the peer VPN gateway is an on-premises configuration, not a Google Cloud control, and it wouldn't enforce the restriction at the Google Cloud project/organization level.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed