Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a Cloud NAT gateway using a Cloud Router

  Why this is correct

  Cloud NAT, configured through a Cloud Router, provides managed outbound internet connectivity to private Compute Engine instances without assigning them external IP addresses. It uses the Cloud Router to dynamically exchange routing information with the VPC network, allowing instances with internal IPs to initiate connections to the internet while remaining unreachable from outside. This is the recommended, highly available, and serverless solution because Cloud NAT automatically scales to handle thousands of instances and does not require manual patching or failover configuration.

• ✗

  Disable Private Google Access and assign external IPs to the instances

  Why it's wrong here

  Disabling Private Google Access and assigning external IPs to the instances is incorrect because Private Google Access is specifically for reaching Google APIs and services, not general internet traffic. Disabling it removes that controlled access, while assigning external IPs makes each instance publicly reachable, widening the attack surface and requiring additional firewall rules to mitigate exposure. It also introduces per-instance public IP costs and contradicts the best practice of keeping VM workloads private and protected behind a managed NAT service.

• ✗

  Add a NAT instance (a Compute Engine VM configured as a NAT gateway)

  Why it's wrong here

  Using a NAT instance—a Compute Engine VM configured with IP forwarding and iptables—is a legacy approach that requires you to manage and secure the instance yourself. It becomes a single point of failure unless you build complex HA schemes, and you must manually scale it to handle connection bursts or add load balancers. This adds operational overhead, licensing, and VM costs, whereas Cloud NAT is a fully managed service that scales automatically and requires no instance maintenance.

• ✗

  Create a Cloud VPN tunnel to a third-party NAT service

  Why it's wrong here

  Creating a Cloud VPN tunnel to a third-party NAT service is unnecessarily complex and conceptually mismatched because Cloud VPN is designed for site-to-site connectivity between your VPC and on-premises or partner networks, not as a path to a NAT proxy. You would need to provision, secure, and pay for the third-party NAT service, and then route traffic through an external VPN, adding substantial latency and egress costs. This convoluted design provides no benefit over Cloud NAT, which gives direct, low-latency, managed internet access from within Google's network.

Go deeper

Related to this question