PCNE Implementing a Virtual Private Cloud Practice Question
A company uses Cloud NAT to allow instances without external IPs to access the internet. They have a managed instance group (MIG) in us-central1 with 10 instances, all using the same Cloud NAT configured with a single NAT IP address. They notice that some instances are unable to connect to a specific external API endpoint, while others can. The error on the failing instances is 'Cannot connect to host'. The NAT IP is not blacklisted by the API. The Cloud NAT gateway has default settings with a minimum port per VM of 64 and a maximum of 65536. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port exhaustion is occurring; increase the number of NAT IPs or increase the minimum ports per VM.
Cloud NAT uses source network address translation (SNAT) and maps internal IPs to the NAT IP using ports. By default, Cloud NAT allocates a range of ports per VM. If the instances are making many connections, they may exhaust the allocated ports. The symptom that only some instances fail suggests that the failing instances may have run out of ephemeral ports. Option D is correct: Increase the number of NAT IP addresses or increase the minimum ports per VM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The instances are using different service accounts, and the NAT is not configured to allow all.
Why it's wrong here
Cloud NAT applies to all instances in the subnet, regardless of service account.
- ✗
The Cloud NAT's idle timeout is set too low, causing connections to be dropped.
Why it's wrong here
Idle timeout would affect long-lived connections, but the error is immediate.
- ✗
The external API endpoint has a rate limit that is being hit by the NAT IP.
Why it's wrong here
If it were a rate limit, all instances would fail, not just some.
- ✓
Port exhaustion is occurring; increase the number of NAT IPs or increase the minimum ports per VM.
Why this is correct
Port exhaustion affects VMs that make many outbound connections; increasing NAT IPs provides more ports.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.