Google ACE Planning and Configuring a Cloud Solution Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Place web servers in a subnet with Cloud NAT, and database servers in the same subnet without public IP

  Why it's wrong here

  Placing both web and database servers in a single subnet with Cloud NAT leaves the web tier with no inbound connectivity path, because Cloud NAT supports only outbound connections. Web servers typically must accept direct user traffic, which requires public IPs or an external load balancer, not NAT. Additionally, co-locating the database and web tiers in the same subnet removes network-level isolation, so a compromised web server can easily reach the database without traversing a firewall boundary.

• ✓

  Place web servers in a subnet with public IPs, and database servers in a separate subnet with Cloud NAT and no public IP

  Why this is correct

  This is the recommended design because web servers get public IPs (or are behind an external load balancer) to accept inbound user connections, while database servers remain in a separate private subnet with no public IP, preventing direct internet access. Cloud NAT on the database subnet allows outbound internet requests for updates or external APIs without exposing the database to inbound traffic. Separate subnets also enable granular VPC firewall rules and routing policies between tiers, reducing the blast radius if the web tier is compromised.

• ✗

  Place both tiers in the same subnet with no public IPs and use Cloud NAT for all outbound traffic

  Why it's wrong here

  This configuration completely eliminates inbound connectivity to web servers, as Cloud NAT is a one-way outbound service and cannot forward unsolicited internet traffic to instances. With no public IPs and no load balancer, users have no way to reach the application. Furthermore, sharing a single subnet between web and database tiers violates the principle of least privilege—lateral movement from the web tier to the database is unrestricted, and you also lose the ability to apply separate firewall rules to each tier.

• ✗

  Place web servers in a subnet with Cloud NAT, and database servers in a subnet with public IPs and firewall rules to restrict inbound

  Why it's wrong here

  Assigning public IPs to database servers is a serious security risk, as it exposes the database directly to the internet; firewall rules are often misconfigured and provide only filtering that can be bypassed via misconfigurations. Meanwhile, the web tier is placed behind Cloud NAT, which only enables outbound traffic, so the web servers cannot receive inbound user requests. The correct architecture keeps the database fully private, allows outbound via Cloud NAT for updates, and gives the web tier public IPs or a load balancer for inbound traffic.

Go deeper

Related to this question