Google ACE Configuring Access and Security Practice Question
You are configuring a Cloud NAT to allow private Compute Engine instances to access the internet for updates. What other resource is required to set up Cloud NAT?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Cloud Router
Cloud NAT requires a Cloud Router to manage dynamic routing and NAT configurations. The Cloud Router is created in the same region and VPC network as the NAT gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A Cloud VPN tunnel
Why it's wrong here
A Cloud VPN tunnel is used to securely connect an on-premises network to a Google Cloud VPC over the public internet. It does not provide NAT functionality or integrate with Cloud NAT's required underlying infrastructure. Cloud NAT specifically needs a Cloud Router to dynamically exchange routes and enable NAT IP address allocation, which a VPN tunnel cannot do.
- ✗
An interconnect attachment
Why it's wrong here
An interconnect attachment (VLAN attachment) is part of Dedicated or Partner Interconnect, providing high-bandwidth, low-latency connectivity between an on-premises network and Google Cloud. It is a physical or logical layer-2 connection and does not perform network address translation. Cloud NAT relies on a Cloud Router to manage NAT IP addresses and advertise routes, so an interconnect attachment is irrelevant to its configuration.
- ✓
A Cloud Router
Why this is correct
A Cloud Router is the correct component because Cloud NAT requires a Cloud Router in the same region and VPC network to function. The Cloud Router holds the NAT gateway's configuration, manages the NAT IP addresses, and dynamically exchanges routes with the VPC network. Without a Cloud Router, Cloud NAT cannot be created or operate, making it the essential resource for allowing private Compute Engine instances to access the internet or other destinations while remaining private.
- ✗
A VPC peering connection
Why it's wrong here
VPC peering connects two VPC networks so that instances in different networks can communicate using private IP addresses, but it does not provide internet access or NAT services. Cloud NAT is designed to give instances without external IPs outbound internet connectivity, and it requires a Cloud Router in the same region to handle the NAT configuration. VPC peering does not replace or contribute to the NAT setup, so it is not a required or sufficient resource.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Compute Engine
Compute Engine is Google Cloud's Infrastructure-as-a-Service (IaaS) offering that lets you create and run virtual machines on Google's infrastructure.
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.