easyMultiple Choice
Google ACE Practice Question: A company has a set of Compute Engine instances…
A company has a set of Compute Engine instances in a VPC that need outbound internet access for updates, but they do not have public IP addresses. The instances are running in a subnet with Private Google Access enabled. Which service should the company use to provide internet access?
⚠ Common exam trap
ACE often tests the distinction between Private Google Access (for Google APIs) and Cloud NAT (for general internet). Candidates may incorrectly select Private Google Access for internet access because they confuse the two.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud NAT
Cloud NAT is the correct service to provide outbound internet access for instances without public IPs. Cloud NAT allows instances in a private subnet to connect to the internet for updates while preventing unsolicited inbound connections. It works with Private Google Access enabled, which only allows access to Google APIs and services, not general internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Private Google Access
Why it's wrong here
Private Google Access only permits instances without external IPs to reach Google APIs and services, not arbitrary internet destinations. It is tempting because it already enables Google traffic, but general outbound internet requires Cloud NAT attached to the subnet's region.
- ✗
A default route to the internet gateway
Why it's wrong here
A default route to an internet gateway only works when the instance has an external IP for NAT translation; without one, traffic is dropped. It is tempting as the standard egress path, but instances lacking public addresses need Cloud NAT to perform the translation.
- ✓
Cloud NAT
Why this is correct
Cloud NAT provides outbound internet access for instances without public IP addresses by translating their traffic through a NAT gateway. Private Google Access only reaches Google APIs, not the public internet, so Cloud NAT is required for external updates.
- ✗
Cloud VPN
Why it's wrong here
Cloud VPN tunnels traffic between on-premises networks and a VPC, so it cannot give instances without public IPs outbound internet access. It is tempting because it does provide connectivity, but that connectivity terminates at a peer network, not the internet; a Cloud NAT gateway is what translates private addresses for egress.
Visual reference
Go deeper
Related to this question
Learn chapter
App Engine Standard vs Flexible
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
Courseiva writes every ACE question from scratch — 775 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.