PCNE Configuring Network Services Practice Question
A company has Compute Engine instances in a VPC that only have internal IP addresses. They need to access Google Cloud services like Cloud Storage and BigQuery. They also have on-premises servers that need to access the same instances via a Cloud VPN tunnel. What must be enabled for the instances to access Google APIs without public IPs?
⚠ Common exam trap
Google Cloud often tests the distinction between Cloud NAT (for general internet outbound) and Private Google Access (specifically for Google APIs), leading candidates to mistakenly choose Cloud NAT when the question explicitly requires access to Google services without public IPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Private Google Access
Private Google Access enables Compute Engine instances that have only internal IP addresses (no external IPs) to reach Google APIs and services such as Cloud Storage and BigQuery. It works by routing traffic destined for Google API IP ranges through the default internet gateway, using the VPC's internal DNS resolution to map the API hostnames to Google's internal IP addresses, without requiring a public IP on the instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Private Google Access
Why this is correct
Private Google Access enables access to Google APIs from internal IPs without public IPs.
- ✗
Cloud Router
Why it's wrong here
Cloud Router is for dynamic routing with on-premises, not for API access.
- ✗
VPC peering
Why it's wrong here
VPC peering is for connecting two VPCs, not for accessing Google APIs.
- ✗
Cloud NAT
Why it's wrong here
Cloud NAT provides internet access, but Google APIs can be accessed privately without NAT.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.