Google ACE Planning and Configuring a Cloud Solution Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a VPC peering connection to a network with internet access

  Why it's wrong here

  VPC peering only establishes private IP connectivity between two VPC networks; it does not act as an internet gateway, and the peered network's internet access is not automatically extended to your instance. Furthermore, peering does not support transitive routing, so even if the other VPC has a NAT gateway or a public IP, your instance cannot inherit that egress path. To reach the internet, your VPC must have its own route to a NAT gateway or an external IP.

• ✓

  Create a firewall rule that allows egress traffic to the internet

  Why this is correct

  A firewall rule that allows egress traffic to the internet is mandatory for any outbound connectivity, even when Cloud NAT is used. Cloud NAT only translates the source IP, but the VPC firewall still evaluates all traffic and drops it unless a rule permits traffic to destination 0.0.0.0/0 with a source tag or service account you apply to the instance. Without an egress allow rule, the NAT translation never gets the chance to send packets, because the firewall is applied before the packet leaves the instance's VPC network.

• ✓

  Create a Cloud NAT gateway in the same region and VPC as the instance

  Why this is correct

  Cloud NAT is the correct mechanism to provide outbound internet connectivity to a private instance because it lets the instance use its private IP address to initiate connections to the internet while preserving the security benefits of not exposing a public IP. It must be configured in the same region and VPC as the instance, and it depends on a Cloud Router that dynamically advertises routes for the NAT gateway. Cloud NAT is not a firewall; it simply performs source NAT on egress packets, so it works alongside the required egress firewall rule.

• ✗

  Attach the instance to a load balancer

  Why it's wrong here

  A load balancer (whether internal or external) is designed to distribute inbound traffic to backend instances based on forwarding rules, and it does not provide any outbound path for the instances themselves. Attaching an instance to a load balancer only affects how traffic is routed to it, not how the instance initiates connections to the internet. Private instances still need a NAT gateway, a public IP, or a proxy on a separate path to make outbound connections; a load balancer is not a substitute.

• ✗

  Assign a public IP address to the instance

  Why it's wrong here

  Assigning a public IP address to the instance would technically give it internet egress via Google's standard per-instance NAT, but it contradicts the design goal of keeping the instance private and shielded from inbound internet traffic. A public IP exposes the instance directly to the public internet, making it accessible unless tightly restricted by firewall rules, and it defeats the purpose of using Cloud NAT with private addresses. The preferred architecture is to leave the instance with only a private IP and use Cloud NAT to allow controlled outbound access while minimizing the attack surface.

Go deeper

Related to this question