PCNE Implementing a Virtual Private Cloud Practice Question

A network engineer wants to allow specific instances to use Cloud NAT while others should not. Which configuration step should be taken?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Apply a network tag to instances that should use NAT and create a Cloud NAT with that tag.

Cloud NAT uses network tags to filter which instances use it.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Assign external IPs to non-NAT instances.
Why it's wrong here
Instances with external IPs bypass Cloud NAT, but this is not the best practice for selective use.
✗
Use firewall rules to allow NAT for tagged instances.
Why it's wrong here
Firewall rules do not control which instances use Cloud NAT.
✓
Apply a network tag to instances that should use NAT and create a Cloud NAT with that tag.
Why this is correct
This is the standard method to select which instances are NATed.
✗
Create separate subnets for NAT instances.
Why it's wrong here
Cloud NAT works at the subnet level, but this is not the recommended way to filter instances.

Visual reference

Go deeper