Google ACE Configuring Access and Security Practice Question
A company wants to use Cloud NAT to allow private instances in a VPC to send outbound traffic to the internet and to receive inbound responses. Which two resources must be configured to set up Cloud NAT?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Router and NAT gateway
Cloud NAT requires a Cloud Router (to manage dynamic routing and NAT IP allocation) and a NAT gateway (the actual NAT service). The Cloud Router is a separate resource that must be created in the same region as the NAT gateway. The NAT gateway configuration includes the Cloud Router name.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cloud Router and NAT gateway
Why this is correct
Cloud NAT is implemented as a NAT gateway configured on a Cloud Router, and this pair is the required core of the service. The Cloud Router holds the NAT IP addresses and manages the dynamic routes (via BGP) that allow private instances to use them, while the NAT gateway performs source address translation for outbound connections. Without a NAT gateway, a Cloud Router alone cannot translate addresses, which is why both components are mandatory for a functioning Cloud NAT.
- ✗
Cloud Router only
Why it's wrong here
A Cloud Router alone is only a BGP-based dynamic routing service that exchanges routes between your VPC and on-premises networks; it does not perform address translation. To provide outbound internet access to private instances, you must create a NAT gateway on the Cloud Router and assign NAT IP addresses. Without that gateway, the router has no mechanism to translate private source IPs, so instances remain unable to reach the internet.
- ✗
Cloud VPN and Cloud NAT
Why it's wrong here
Cloud VPN is used to create encrypted tunnels back to on-premises networks and is entirely unrelated to providing outbound internet access for private instances. Cloud NAT does not require or use a VPN tunnel; it runs on a Cloud Router and translates source IPs from private ranges to the NAT IPs. Adding a VPN would be an unnecessary and separate connectivity service, and it would not satisfy the need for a dedicated NAT gateway.
- ✗
Cloud Interconnect and Cloud NAT
Why it's wrong here
Cloud Interconnect provides dedicated, high-bandwidth connectivity between your on-premises network and Google's network, often for hybrid workloads; it does not perform NAT or manage outbound internet traffic. Cloud NAT's purpose is address translation for private VMs, which still requires a Cloud Router and a NAT gateway. Interconnect is an optional network connectivity product and cannot replace or complement NAT requirements in this scenario.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.