PCNE Configuring Network Services Practice Question
A service provider uses a Shared VPC with multiple service projects. The host project has a Cloud NAT configured for subnet 10.1.0.0/24 to provide outbound internet access to all service projects using that subnet. A new service project needs to use its own Cloud NAT for its VM instances in subnet 10.1.0.0/24 to meet compliance requirements. The network engineer attempts to create a Cloud NAT in the service project for that subnet but receives an error that the subnet already has a NAT gateway. What action should the engineer take to meet the compliance requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the host project's NAT from the subnet and create a Cloud NAT in the service project for that subnet.
A subnet can have only one NAT gateway associated. To allow the service project to use its own Cloud NAT for subnet 10.1.0.0/24, the host project's Cloud NAT must first be removed from that subnet. Then the service project can create its own Cloud NAT for the same subnet. Option A is not possible due to the conflict. Option B (VPC peering) would not allow the service project to have its own NAT on the same subnet. Option C (proxy instance) introduces management overhead and is not a native solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new Cloud NAT in the service project for the same subnet, overwriting the existing one.
Why it's wrong here
You cannot have two NAT gateways on the same subnet; you must remove the existing one first.
- ✗
Use VPC peering to connect the service project to a different network that has a Cloud NAT.
Why it's wrong here
Peering does not allow the service project to control NAT on the shared subnet.
- ✗
Implement a proxy instance with an external IP in the service project.
Why it's wrong here
While functional, this is not a managed service and violates the requirement to use native Cloud NAT.
- ✓
Remove the host project's NAT from the subnet and create a Cloud NAT in the service project for that subnet.
Why this is correct
This removes the conflict and allows the service project to manage its own NAT.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.