Google ACE Practice Question: A company has a VPC with several Compute Engine…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use VPC Network Peering with a public network.

  Why it's wrong here

  VPC Network Peering is a private, internal connectivity mechanism that directly interconnects two VPC networks via RFC 1918 addresses; it is not a gateway to the internet. Peering carries traffic only between the peered networks, never to external hosts, and it does not perform source NAT or provide a public egress path. A public network is not a VPC, so this option fails on both architecture and functionality: no peering with 'the internet' exists, and outbound traffic from private instances would still need an internet gateway or Cloud NAT.

• ✗

  Set up a Cloud VPN gateway to route traffic to on-premises.

  Why it's wrong here

  A Cloud VPN gateway creates an encrypted IPSec tunnel to an on-premises router, establishing hybrid connectivity for private traffic between your VPC and a specific on-premises network. It is designed to reach corporate resources such as databases or internal services, not to provide general internet egress. Even if you routed default traffic through the tunnel, the on-premises side would need its own NAT and internet access, adding complexity and latency; the correct Google Cloud-native solution is Cloud NAT, which directly translates private instance addresses to a public egress IP.

• ✗

  Place the instances behind an external HTTP(S) load balancer.

  Why it's wrong here

  An external HTTP(S) load balancer terminates incoming client requests and distributes them to backend instances; it operates on the ingress path, not the egress path. For outbound connections initiated by the instances themselves, the load balancer plays no role—it does not perform source NAT and cannot give a private instance an external IP for outbound traffic. In fact, load-balanced backends typically run in private subnets and still require Cloud NAT for outbound internet access, so this option confuses inbound load balancing with outbound connectivity.

• ✓

  Configure Cloud NAT in the same region and subnet.

  Why this is correct

  Cloud NAT (Network Address Translation) is the correct Google Cloud service for enabling outbound internet access from Compute Engine instances that have only private IP addresses. When you configure Cloud NAT on a Cloud Router for a specific region and subnet, it provides a set of external IP addresses that are used to translate the private source IPs of outbound packets. This allows the instances to reach the internet while remaining private and secure, without the need for individual external IPs. Cloud NAT is also region-scoped, so configuring it for the same region and subnet as the instances is both necessary and sufficient for this VPC requirement.

Go deeper

Related to this question