Google ACE Planning and Configuring a Cloud Solution Practice Question
A company needs to provide outbound internet access to private Compute Engine instances that do not have external IP addresses. The instances must be able to download updates from the internet. Which service should be configured?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud NAT
Cloud NAT enables private instances to access the internet for outbound connections while blocking inbound connections from the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC peering
Why it's wrong here
VPC peering merely creates private RFC 1918 connectivity between two VPC networks so instances can communicate using internal IP addresses. It does not provide a default route to the internet and does not perform source NAT, so a private instance in a peered network still cannot reach public destinations. For outbound internet, you need a gateway or NAT service such as Cloud NAT.
- ✗
Cloud VPN
Why it's wrong here
Cloud VPN establishes an encrypted IPsec tunnel between your VPC and an on-premises or third-party network over the public internet, but it is not an internet egress service. Traffic sent through the tunnel is delivered to the remote network, not translated and released to the open internet. It also does not provide source NAT for instances lacking external IPs, so it cannot give them general outbound internet access.
- ✓
Cloud NAT
Why this is correct
Cloud NAT is a managed source network address translation service that enables instances without external IP addresses to make outbound connections to the internet while allowing only corresponding return traffic. It works with Cloud Router to automatically configure NAT for a VPC network and supports mapping of private IPs to a set of external IP addresses, making it the correct solution for this requirement.
- ✗
Private Google Access
Why it's wrong here
Private Google Access permits instances with only private IP addresses to reach Google APIs and services through Google's internal network, but it does not provide general internet connectivity. It uses DNS resolution and special routes for googleapis.com and other Google domains, not for arbitrary public hosts. Therefore, it is not a substitute for Cloud NAT when the company needs outbound access to the entire internet.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
NAT
NAT (Network Address Translation) is a method that allows multiple devices on a private network to share a single public IP address when accessing the internet.
Key term
Cloud NAT
Cloud NAT is a managed network address translation service that allows private cloud resources to initiate outbound internet connections while keeping them unreachable from the internet.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.