mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A GCP project needs to allow outbound internet…
A GCP project needs to allow outbound internet access from VMs that have only private IP addresses, without exposing those VMs to inbound internet traffic. Which GCP service provides this?
⚠ Common exam trap
Many candidates confuse egress firewall rules (which only permit traffic to leave) with the need for a NAT gateway to provide a routable public source IP for return traffic, leading them to incorrectly select the firewall rule option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud NAT configured on the VPC's Cloud Router
Cloud NAT (Network Address Translation) is the correct service because it allows VMs with only private IP addresses to initiate outbound connections to the internet while preventing any inbound connections from the internet. It works by translating the private source IP addresses of outbound packets to a set of ephemeral public IP addresses managed by Google, using the VPC's Cloud Router to dynamically allocate NAT IPs and ports. This meets the requirement of outbound-only internet access without exposing the VMs to inbound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud VPN connecting the VPC to the internet
Why it's wrong here
Cloud VPN establishes an IPsec tunnel between your VPC and an on-premises network or another cloud provider, and while you could theoretically route traffic to the internet via an on-premises gateway, this is not the purpose of Cloud VPN and would require complex routing and NAT configuration in the remote environment. The VPN tunnel itself does not provide external connectivity to GCP VMs; it merely extends your private network over the public infrastructure. For pure outbound internet access from private VMs, Cloud NAT is the appropriate, managed service, not Cloud VPN.
- ✓
Cloud NAT configured on the VPC's Cloud Router
Why this is correct
Cloud NAT, configured on a Cloud Router in the VPC, provides outbound-only internet connectivity by translating the private IPs of VMs to an external IP address pool owned by Google, while never accepting inbound connections initiated from the internet. Because the VMs retain no public IP address, they remain protected from unsolicited inbound traffic, and the Cloud Router permits the NAT functionality to be shared across all privately addressed instances in the region. This is the standard GCP solution for allowing private instances to reach the internet for updates or external API calls.
- ✗
A VPC firewall rule allowing egress to 0.0.0.0/0 on all ports
Why it's wrong here
A firewall egress rule allowing traffic to 0.0.0.0/0 is a necessary access-control policy, but it is not sufficient to connect private-only VMs to the internet because firewalls do not implement address translation or routing. In a VPC, a VM with only an internal IP address has no unique public source address to send packets, and without a default route via an internet gateway, a NAT gateway, or an external IP on the instance, the egress packets are not routable to the internet. Thus, the rule alone leaves the routing and translation problem unresolved.
- ✗
An internal load balancer with internet routing enabled
Why it's wrong here
An internal load balancer (ILB) is a regional, private IP-based load balancer that distributes traffic among backend instances inside your VPC, and it does not provide any form of source NAT or internet gateway function. Enabling 'internet routing' on an ILB is not a supported configuration; the ILB forwards traffic only between clients and backends within the same VPC or connected networks, and it cannot be used to give VMs with only private IPs an egress path to the public internet. Therefore, this option fails to solve the requirement for outbound internet access.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud NAT
Cloud NAT is a managed network address translation service that allows private cloud resources to initiate outbound internet connections while keeping them unreachable from the internet.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.