Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The instances have external IP addresses assigned.

  Why this is correct

  Cloud NAT is designed to provide source network address translation for private instances that do not have external IP addresses. If an instance is assigned an external IP, even an ephemeral one, its outbound traffic will use that IP as the source address, completely bypassing Cloud NAT. Therefore, the observation that traffic is 'not being NATed' is exactly what would happen when instances have external IPs, not a sign of NAT misconfiguration.

• ✗

  The Cloud Router is not configured correctly.

  Why it's wrong here

  Cloud Router is an essential dependency for Cloud NAT because it provides the BGP session and dynamic routing that the NAT gateway uses to advertise and learn routes. However, a misconfigured Cloud Router would typically cause BGP peering issues or route advertisement failures, which would result in no internet connectivity at all rather than traffic that is still successfully egressing but with an unexpected source IP. Since the traffic is visible but not NATed, the simpler and most likely cause is the presence of external IPs on the instances, not a Cloud Router configuration problem.

• ✗

  The firewall rules block egress traffic.

  Why it's wrong here

  VPC firewall rules are stateful and can indeed block outbound (egress) traffic, but the symptom of 'not being NATed' implies that traffic is flowing—just without the expected source address translation. If firewall rules were blocking egress, connections to the internet would time out or be refused entirely, not appear as NATed or non-NATed. The diagnostic clue is about the source IP on packets as they leave the VPC, which firewall rules do not modify, so they are not the reason for the missing NAT.

• ✗

  The instances are in a different region than the Cloud NAT gateway.

  Why it's wrong here

  Cloud NAT is a regional resource, so an instance in a different region from the NAT gateway would not use it; instead, you would need a separate Cloud NAT in that instance's own region. If a company has a single Cloud NAT in one region and instances are in another, those instances either would need their own NAT or would rely on external IPs. However, the question's wording 'using Cloud NAT' implies the instances are intended to use this specific NAT, and assuming they are in the same region, the most direct explanation for non-NATed traffic is that the instances have external IP addresses assigned.

Go deeper

Related to this question