PCNE Implementing VPC Instances Practice Question
An engineer needs to provide outbound internet access to Compute Engine instances that do not have external IP addresses. The solution must allow instances to access a specific set of external IPs only. What should the engineer configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Cloud NAT gateway and configure firewall egress rules to allow traffic only to the specific IPs.
Cloud NAT with firewall rules can restrict outbound traffic to specific destinations. By default, Cloud NAT uses the instance's network tags and firewall egress rules to control traffic. The engineer can create an egress deny rule with higher priority for all destinations, then an egress allow rule for the specific IPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Private Google Access only, which provides access to Google APIs and services.
Why it's wrong here
Private Google Access only covers Google APIs, not arbitrary external IPs.
- ✓
Create a Cloud NAT gateway and configure firewall egress rules to allow traffic only to the specific IPs.
Why this is correct
Cloud NAT provides outbound connectivity for instances without external IPs, and firewall rules can restrict traffic to specific destinations.
- ✗
Assign external IPs to instances and use firewall rules to restrict outbound traffic.
Why it's wrong here
Assigning external IPs defeats the requirement of instances without external IPs.
- ✗
Deploy a NAT instance with iptables rules to restrict destination IPs.
Why it's wrong here
While possible, Cloud NAT is the managed service recommended by Google; NAT instance is a legacy approach.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.