PCNE Configuring Network Services Practice Question
A company uses Cloud NAT to allow private VMs to access the internet. They notice that some VMs are unable to reach a specific set of external IP addresses, but other VMs can. The firewall rules are correctly configured. What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the misconception that firewall rules within the VPC are the only cause of connectivity failures, when in reality external service firewalls or IP allowlists can block traffic after NAT translation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Cloud NAT gateway uses a static IP address that is not allowed by the external service's firewall.
Cloud NAT uses a source IP address (either a static IP you assign or an ephemeral IP from the NAT gateway's IP range) when translating outbound traffic from private VMs. If the external service's firewall only allows traffic from specific IP addresses, and the Cloud NAT gateway is using a static IP that is not on that allowlist, the affected VMs' traffic will be blocked. Other VMs might reach the service if they use a different NAT gateway or if the service's firewall permits their translated IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The default route (0.0.0.0/0) is missing for the VPC.
Why it's wrong here
Missing default route would affect all VMs, not just some.
- ✗
The VPC firewall rules have a deny rule for the source IP range of the affected VMs.
Why it's wrong here
Firewall rules apply to VM instances, but the issue is with external reachability, not internal.
- ✓
The Cloud NAT gateway uses a static IP address that is not allowed by the external service's firewall.
Why this is correct
If the external service restricts access by IP, only VMs using that NAT IP can connect.
- ✗
The VMs have a tag that overrides the Cloud NAT routing.
Why it's wrong here
Tags do not affect NAT routing.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.