PCNE Cloud NAT Practice Question
A company uses Cloud NAT to enable outbound connectivity for private VMs. They notice that some VMs are not able to reach a specific external IP range. The VMs have no tags or service accounts. What is the most likely cause?
⚠ Common exam trap
A common mistake is to assume that a static route for the external IP range is necessary when Cloud NAT seems to block specific addresses. However, Cloud NAT uses the default route, and the actual issue is often that the VMs are in a subnet without Cloud NAT configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VMs might be in a different subnet than the one where Cloud NAT is configured.
The most likely cause is that the VMs are in a subnet that does not have Cloud NAT configured. Cloud NAT is configured on a per-subnet basis, and only VMs in subnets with Cloud NAT enabled can use it for outbound traffic. Option A is incorrect because Cloud NAT does not require each VM to have a unique external IP; it uses a pool of NAT IPs. Option B is incorrect because VMs already have a default route (0.0.0.0/0) via the default internet gateway, and Cloud NAT works with that route; there is no need for a route pointing to the NAT gateway. Option C is incorrect because no static route is needed for specific external IP ranges; Cloud NAT uses the default route and performs source NAT for all outbound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud NAT requires each VM to have a unique external IP address.
Why it's wrong here
This is incorrect. Cloud NAT does not assign unique external IPs per VM; it can use shared NAT IPs.
- ✗
The VMs need a default route pointing to the NAT gateway.
Why it's wrong here
This is incorrect. The required route is a default route (0.0.0.0/0) pointing to the internet gateway, not directly to the NAT gateway.
- ✗
A static route must be created for the external IP range via the NAT gateway.
Why it's wrong here
This is incorrect. No static route is needed for the external IP range; Cloud NAT uses the default route to determine which traffic to NAT.
- ✓
The VMs might be in a different subnet than the one where Cloud NAT is configured.
Why this is correct
This is correct. Cloud NAT is configured per subnet. If VMs are in a different subnet without Cloud NAT, they cannot use it for outbound connectivity.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.