PCNE Configuring Network Services Practice Question
A company uses Cloud NAT to allow private instances to reach the internet. They notice that egress traffic from Compute Engine VMs is intermittently failing. The VMs are in us-central1-a and use the default VPC network. Cloud NAT is configured with a single NAT IP address. What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the misconception that Cloud NAT automatically scales with traffic or that a single NAT IP is sufficient for any workload, when in reality port exhaustion is a common scaling bottleneck.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Port exhaustion due to insufficient NAT IP addresses
Cloud NAT uses source network address translation (SNAT) to map private VM IPs to a public NAT IP. With only a single NAT IP address, the available port range (typically 64,512 ephemeral ports per NAT IP per VM) can be exhausted under high egress traffic, causing intermittent failures. This is the most likely cause given the symptom of intermittent failures and the single IP configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Missing default route to Internet gateway
Why it's wrong here
Default VPC has a default route.
- ✓
Port exhaustion due to insufficient NAT IP addresses
Why this is correct
A single NAT IP provides limited ports; many VMs can exhaust them.
- ✗
Cloud NAT not configured in the correct region
Why it's wrong here
Cloud NAT is regional; VMs in us-central1-a are in the same region.
- ✗
Firewall rule blocking egress traffic from VM
Why it's wrong here
Default VPC allows egress; no evidence of custom rules.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.