hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A company has a Compute Engine instance in the…
A company has a Compute Engine instance in the us-west1 region that does not have a public IP address. The instance is part of a VPC network that has a Cloud NAT gateway configured in the us-east1 region. The Cloud NAT gateway is configured to allow all traffic from the VPC subnet. The VPC has a default route (0.0.0.0/0) pointing to the default internet gateway. Firewall rules allow all egress traffic. The instance is unable to download updates from the internet. What is the most likely cause of this problem?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Cloud NAT gateway is in a different region than the instance.
Cloud NAT is regional. An instance in us-west1 cannot use a Cloud NAT gateway in us-east1 because NAT is only applied to instances in the same region. The instance's traffic destined for the internet is not translated, so it cannot reach external hosts without a public IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The instance's firewall rules block egress traffic to port 80.
Why it's wrong here
The stem explicitly states that the VPC's firewall rules allow all egress traffic, so no firewall rule is blocking port 80 or any other outbound port. Cloud NAT is compatible with permissive egress rules; it does not require a specific allow rule beyond what permits the traffic itself. Thus, this option contradicts the given facts and cannot be the cause of the connectivity failure.
- ✓
The Cloud NAT gateway is in a different region than the instance.
Why this is correct
Cloud NAT is strictly regional: each Cloud NAT gateway is attached to a specific region and only serves VM instances located in that same region. An instance in us-west1 cannot use a NAT gateway configured in, say, us-central1, even if it is in the same VPC network. This regional mismatch directly explains why outbound internet access fails, making it the correct answer.
- ✗
The instance's service account does not have the compute.instances.update permission.
Why it's wrong here
The instance's service account is used for authentication and authorization to Google Cloud APIs, not to control network connectivity or NAT behavior. Cloud NAT does not inspect the instance's service account when forwarding traffic. The relevant identity would be the Cloud NAT's own service account, which the deployment likely already has, so a missing compute.instances.update permission on the instance is irrelevant.
- ✗
The VPC does not have a route for the instance's subnet to the internet gateway.
Why it's wrong here
A route to the internet gateway (the default 0.0.0.0/0 route) is indeed required for Cloud NAT to forward traffic, and the scenario confirms this route exists in the VPC. Since the route is present, this option is factually incorrect as an explanation. Even when the route exists, a NAT gateway in the wrong region will still prevent the instance from reaching the internet, so the root cause remains the regional mismatch.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.