A research group wants notebook instances that can query a warehouse dataset but must have no route to the public internet. Which setup meets both requirements?
Show answer and explanation
Answer: C
Private Google Access lets virtual machines without external IP addresses reach Google APIs, including the warehouse API, over Google's internal network. Removing the external address means the instance has no public route at all. This satisfies both needs: the notebook can query the dataset, and it cannot send traffic to the public internet. IAM controls who may read data, but it does not restrict network paths, so it cannot meet the no-internet requirement by itself.
Why the other options are wrong
- A. Disabling the API blocks querying entirely, and local exports bypass the governed access the group needs for live analysis.
- B. IAM limits authorization, not network routes. The instance could still reach the public internet, so the no-internet requirement is unmet.
- D. Cloud NAT provides outbound internet access, which is exactly what must be prevented, even though inbound traffic is blocked.