Securely Connecting Compute Engine to Cloud Storage via Private Service Connect
Short answer
BE Create a Cloud DNS private zone for googleapis.com and associate it with the VPC, then create a regional Private Service Connect endpoint targeting Cloud Storage.
Question
Key Takeaways
The question tests the distinction between general private connectivity (Private Google Access/NAT) and true private service endpoints (PSC), emphasizing that PSC combined with proper DNS resolution is the most secure method.
Learn how to securely connect Compute Engine VMs to Cloud Storage using Private Service Connect and Cloud DNS Private Zones. This guide explains why options B and E are the correct choices for maximum security.
Common mistake: Candidates often choose Private Google Access (A) because it is easier to configure, failing to recognize that PSC (E) offers superior security by keeping traffic entirely within the Google private network and avoiding public IP ranges.
Expert Analysis
The scenario requires secure communication from VMs with only internal IPs to the Cloud Storage API. The key constraint is security and the use of private connectivity.
Option E is correct. Private Service Connect (PSC) provides a private endpoint for Google services like Cloud Storage within your VPC. Traffic never leaves the Google network via public IP ranges, ensuring high security and compliance. This is the most robust method for accessing Google APIs privately.
Option B is correct. To resolve googleapis.com or specific service endpoints like restricted.googleapis.com using internal DNS, you must create a Private Zone in Cloud DNS. Associating this zone with the VPC allows the VMs to resolve these names to their private IP addresses (for PSC) or restricted access IPs. Without a private zone, the VMs would attempt to resolve these names against public DNS, which may not return the correct private routing information needed for the secure path.
Why other options are wrong:
- Option A: Private Google Access allows egress to Google APIs but uses public IP ranges (
146.x.x.x). While it works, it is less secure than PSC because traffic traverses the public internet infrastructure (albeit Google's backbone). Furthermore, Private Google Access does not automatically handle DNS resolution forprivate.googleapis.comin the same explicit way as a Private Zone; it relies on default behavior which might not be sufficient for strict security controls compared to PSC. - Option C: Giving VMs external IPs exposes them to the public internet, violating the "most secure method" requirement.
- Option D: Cloud NAT also uses public IP ranges for egress, similar to Private Google Access, and is less secure than PSC for API calls where private endpoints are available.
The comment mentions "B is about VPC-SC," which is a misunderstanding. Creating a Cloud DNS Private Zone is distinct from VPC Service Controls (VPC-SC), though both can be used together for defense-in-depth. Option B enables the DNS resolution necessary for the private endpoints, while Option E provides the actual private connection.
Exam Strategy
When 'most secure' is specified for Google API access, prioritize Private Service Connect (PSC) over Private Google Access or Cloud NAT. Remember that PSC requires corresponding DNS configuration, typically via Cloud DNS Private Zones, to ensure the application resolves to the private endpoint correctly.
Frequently Asked Questions
What is the difference between Private Google Access and Private Service Connect?
Do I need a Cloud DNS Private Zone if I use Private Service Connect?
Community Votes
50% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
b6f53d8 👍 1A is about Private Service Accrss, B is abbout VPC-SC, so it can not work together, my choice is B and E
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All PCNE Questions
Access 80 questions with complete answers and detailed explanations.
View Full PCNE Practice Test →