PCNE Configuring Network Services Practice Question
A company is using Cloud NAT to allow private instances to access the internet. They notice that some instances are not able to reach certain external services. Which THREE steps should they take to troubleshoot?
⚠ Common exam trap
Google Cloud often tests the misconception that DNS resolution is the primary cause of connectivity failures to external services, when in fact the issue is often at the network layer (e.g., IP blocking or firewall rules) rather than the application layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check if the external service is blocking the Cloud NAT IP addresses.
Cloud NAT uses a set of public IP addresses for outbound traffic. If the external service has firewall rules or access control lists that block these specific IP addresses, the instances will be unable to reach it. Checking for IP-based blocking is a standard first step in troubleshooting connectivity issues through a NAT gateway.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check if the external service is blocking the Cloud NAT IP addresses.
Why this is correct
Some external services may block specific IP ranges, including NAT IPs.
- ✓
Verify that the VPC firewall rules allow egress traffic from the instances.
Why this is correct
Cloud NAT requires firewall rules to allow outbound traffic.
- ✗
Ensure that the VPC has a default route to the internet gateway.
Why it's wrong here
Cloud NAT automatically uses the default route; no explicit route to internet gateway needed.
- ✓
Verify that the Cloud Router associated with Cloud NAT is healthy and has established BGP sessions.
Why this is correct
Cloud NAT uses routes from Cloud Router; if BGP is down, NAT may not work properly.
- ✗
Check the DNS resolution for the external service.
Why it's wrong here
DNS resolution is not related to Cloud NAT functionality.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.