Google PCA Manage and provision cloud infrastructure Practice Question
A company has Compute Engine instances that need to access the internet for updates but should not be reachable from the internet. They also need to access Google APIs and services like Cloud Storage. Which configuration meets these requirements?
⚠ Common exam trap
Candidates often think Cloud NAT alone is sufficient for Google API access, but they miss that Private Google Access must be explicitly enabled on the subnet for instances without external IPs to reach Google APIs and services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Cloud NAT for outbound internet and enable Private Google Access on the subnet.
Cloud NAT provides outbound internet connectivity for instances without external IPs, while Private Google Access allows those same instances to reach Google APIs and services (like Cloud Storage) using internal IPs via the subnet's default route. This combination ensures instances can initiate outbound connections to the internet and Google services but remain unreachable from the internet, meeting both security and functional requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Cloud NAT for outbound internet and enable Private Google Access on the subnet.
Why this is correct
Cloud NAT provides outbound internet access for instances lacking external IP addresses, while Private Google Access lets those instances reach Google APIs and Cloud Storage internally. Together they satisfy both requirements without exposing instances to inbound internet traffic.
- ✗
Assign external IPs to all instances and configure firewall rules to block inbound traffic.
Why it's wrong here
External IPs still expose the instances to the internet; inbound rules can be blocked but outbound access is allowed.
- ✗
Configure a VPN tunnel to an on-premises proxy server for internet access.
Why it's wrong here
Routing egress through an on-premises proxy via VPN adds latency and a dependency on premises connectivity, and it still does not provide private Google API access. It is tempting because VPN tunnels genuinely suit hybrid connectivity to on-premises resources, but Cloud NAT plus Private Google Access satisfies both requirements natively.
- ✗
Use Cloud NAT for outbound internet and use external IPs for Google API access.
Why it's wrong here
Using external IPs for Google API access directly contradicts the requirement that instances should not be reachable from the internet, as it exposes them to public ingress. While Cloud NAT correctly provides outbound internet connectivity for instances without external IPs, the combined approach fails the security constraint. This option is tempting because Cloud NAT is indeed the mechanism for secure outbound internet access, and external IPs *do* facilitate Google API access, but the scenario demands a solution like Private Google Access for internal-only instances to reach Google services securely.
Visual reference
Go deeper
Related to this question
Learn chapter
Cloud Storage: Objects and Buckets
Key term
Cloud NAT
Cloud NAT is a managed network address translation service that allows private cloud resources to initiate outbound internet connections while keeping them unreachable from the internet.
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
About these practice questions
One of 807 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.