PCNE Implementing a Virtual Private Cloud Practice Question

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

⚠ Common exam trap

Google Cloud often tests the misconception that Cloud NAT or Private Google Access can substitute for an external IP when allowing inbound internet traffic, but these services only support outbound or API-specific connectivity, not inbound internet access.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Assign an external IP address to the VM.

A VM must have an external (public) IP address assigned to be directly reachable from the internet. Without an external IP, the VM cannot receive inbound traffic initiated from outside the VPC, even with proper firewall rules. This is a fundamental requirement for internet-facing workloads in Google Cloud.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Configure Cloud NAT for the VPC.
Why it's wrong here
Cloud NAT provides outbound internet, not inbound.
✓
Assign an external IP address to the VM.
Why this is correct
An external IP allows the VM to be reachable from the internet.
✗
Enable Private Google Access on the subnet.
Why it's wrong here
Private Google Access is for accessing Google APIs, not for general internet inbound.
✗
Assign a static internal IP address to the VM.
Why it's wrong here
Internal IP is not needed for inbound internet access.
✓
Create a firewall rule to allow ingress on TCP port 80 from 0.0.0.0/0.
Why this is correct
Firewall rule must permit incoming HTTP traffic.

Visual reference

Go deeper

PCNE Implementing a Virtual Private Cloud Practice Question

Why each option matters

Option-by-option breakdown

Related to this question