Google ACE Configuring Access and Security Practice Question
An organization wants to use Cloud NAT to allow private Compute Engine instances to access the internet for updates. They have a VPC with a custom subnet and a Cloud Router configured. However, instances cannot reach the internet. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Cloud NAT gateway has not been created on the Cloud Router.
Cloud NAT requires a Cloud Router and a NAT gateway configuration on the router. If the NAT gateway is not created, instances cannot use NAT. Other issues like missing routes or firewall rules are possible but less likely when Cloud NAT is set up correctly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Cloud NAT gateway has not been created on the Cloud Router.
Why this is correct
A Cloud Router alone is only a BGP session manager; it does not perform address translation by itself. To enable NAT on a VPC, you must explicitly create a Cloud NAT gateway and attach it to the Cloud Router for a given region and subnetwork, which then maps private IPs to a pool of external IPs. Without that gateway, outbound packets from private instances are dropped when they try to reach the internet, regardless of routing.
- ✗
The instances do not have external IP addresses.
Why it's wrong here
Instances lacking external IP addresses are exactly the use case Cloud NAT is designed to solve. Cloud NAT allows outbound connections from private instances by translating their private source IPs to a NAT IP address, while still preventing inbound direct connections. Therefore, the absence of external IPs is not a misconfiguration; it is the expected prerequisite for using Cloud NAT.
- ✗
The firewall rules block egress traffic.
Why it's wrong here
Cloud NAT operates at the network layer (IP translation) and does not interfere with firewall rules; VPC firewall rules independently control egress traffic based on source/destination IPs, ports, and protocols. The implicit egress rule allows all outbound traffic, so unless a custom deny rule with a lower priority exists, egress is permitted. A firewall block would cause connection timeouts, not the specific NAT failure pattern described.
- ✗
The subnet does not have Private Google Access enabled.
Why it's wrong here
Private Google Access is a separate VPC feature that enables private instances to reach Google APIs and services (like Cloud Storage) through the internal IP ranges 199.36.153.4/30 and 199.36.153.8/30, and it does not provide general internet access. Cloud NAT handles general internet egress, and an instance can have Cloud NAT without Private Google Access. Thus, disabling Private Google Access does not prevent internet-bound traffic from using NAT.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
Key term
NAT Gateway
A NAT Gateway is a managed AWS service that allows instances in a private subnet to connect to the internet or other AWS services while preventing the internet from initiating connections back to those instances.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.