Question 260 of 961
Private Google Access: On-Premises Connectivity with Cloud VPN
A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?
Quick Answer
The answer is a custom route in the VPC that sends traffic to 199.36.153.4/30 and 199.36.153.8/30 to the VPN tunnel. This is required because Private Google Access for on-premises via Cloud VPN relies on these specific IP ranges, which are Google’s private API endpoints, to route traffic from your on-premises hosts through the VPN tunnel and into the VPC without ever touching the public internet. On the Google Professional Cloud Network Engineer exam, this concept tests your understanding that enabling Private Google Access on the subnet is necessary but not sufficient—you must also create a custom static route directing the 199.36.153.4/30 and 199.36.153.8/30 prefixes to the Cloud VPN gateway. A common trap is assuming that enabling Private Google Access alone handles all routing, or confusing these ranges with the default internet gateway. Remember the mnemonic: “Four and eight, route to the gate”—the two /30 subnets must be explicitly pointed to the VPN tunnel for on-premises private access to work.
⚠ Common exam trap
Google Cloud often tests the misconception that Cloud NAT is required for private access, but Private Google Access and custom routes to the 199.36.153.4/30 and 199.36.153.8/30 ranges are the correct components for on-premises private API access via Cloud VPN.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Private Google Access enabled on the subnet where the VPN gateway resides.
Private Google Access enables on-premises hosts to reach Google APIs using private IP addresses when connected via Cloud VPN. It must be enabled on the subnet where the VPN gateway resides so that the VPC routes traffic from the VPN tunnel to Google's private API endpoints. This allows the on-premises hosts to use their private IPs without needing public IPs or internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud DNS forwarding zone to forward requests to Google APIs' public DNS.
Why it's wrong here
Private Google Access does not require DNS changes; it works with standard DNS resolution.
- ✓
Private Google Access enabled on the subnet where the VPN gateway resides.
Why this is correct
This allows on-premises traffic to reach Google APIs via the VPN.
- ✗
Firewall rule allowing ingress from on-premises to 0.0.0.0/0.
Why it's wrong here
Firewall rules need to allow only the specific Google API IP ranges, not all destinations.
- ✗
Cloud NAT configured in the VPC.
Why it's wrong here
Cloud NAT is not required for private Google Access; it is for internet access.
- ✓
A custom route in the VPC that sends traffic to 199.36.153.4/30 and 199.36.153.8/30 to the VPN tunnel.
Why this is correct
These are the IP ranges used for private Google Access; routes must be in place.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on PCNE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A VM in my-subnet without an external IP address cannot access Google APIs. What is the likely missing configuration?
medium- A.Create a Cloud NAT.
- B.Add a firewall rule to allow egress to 0.0.0.0/0.
- ✓ C.Enable Private Google Access on the subnet.
- D.Add a default route to the internet gateway.
Why C: The subnet has privateIpGoogleAccess set to false, which must be enabled for VMs without external IPs to access Google APIs via Private Google Access. Option C (Enable Private Google Access on the subnet) is the correct configuration. Option A (Cloud NAT) is for outbound internet to non-Google destinations, not for Google APIs. Option B is not needed because egress to 0.0.0.0/0 is allowed by default. Option D is not missing; a default route exists as indicated by gatewayAddress.
Variation 2. A company wants to allow their VPC instances to access Google APIs using internal IPs without using a NAT. They have set up Private Google Access on the subnet. What else is required?
medium- A.A default route to the internet must be created.
- B.A Cloud NAT must be configured.
- ✓ C.No additional configuration is needed.
- D.The instances must have external IPs.
Why C: Private Google Access enables instances without external IPs to reach Google APIs using internal IPs. Once enabled on the subnet, Google automatically adds a private route for the Google API IP ranges, so no further configuration is required. Therefore, option C is correct. Option A is incorrect because a default route to the internet would send traffic to the internet, not to Google APIs via private access. Option B is incorrect because Cloud NAT is not needed and would override private access. Option D is incorrect because instances should not have external IPs if using private access.
Variation 3. A company wants to enable Private Google Access for an on-premises network connected via Cloud VPN. Which configuration step is required?
easy- ✓ A.Enable Private Google Access on the VPC subnet that hosts the Cloud VPN gateway.
- B.Enable VPC Flow Logs for the VPN tunnel.
- C.Create a default route with next hop set to the internet gateway.
- D.Configure a Cloud NAT gateway for the on-premises network.
Why A: Private Google Access must be enabled on the VPC subnet that hosts the Cloud VPN gateway. This allows on-premises hosts to use internal IPs to access Google APIs through the VPN tunnel. Option B is incorrect because VPC Flow Logs are for logging, not enabling access. Option C is incorrect because a default route to the internet gateway is not required; traffic goes through the VPN. Option D is incorrect because Cloud NAT is for outbound internet from private instances, not for on-premises access.
Variation 4. Which TWO of the following are required to enable Private Google Access for a subnet?
easy- A.Create a private services access connection.
- ✓ B.Enable Private Google Access on the subnet.
- C.Create a Cloud NAT.
- ✓ D.Configure a default route with next-hop internet gateway.
- E.Enable VPC flow logs.
Why B: To enable Private Google Access, you must enable the setting on the subnet (option B) and have a default route with next-hop internet gateway (option D) for traffic to Google APIs. Option A is incorrect because private services access is for Google managed services like Cloud SQL. Option C is incorrect because Cloud NAT is not required. Option E is incorrect because VPC flow logs are optional.
Variation 5. A security team wants to restrict which Google services can be accessed from their VPC without external IPs. They use Private Google Access. What should they use to block access to specific services?
hard- ✓ A.VPC Service Controls
- B.Firewall rules blocking destination IPs
- C.Cloud NAT with a specific IP range
- D.Private Google Access with restricted VIPs
Why A: VPC Service Controls allows creating security perimeters that restrict access to services.
Last reviewed: Jun 30, 2026
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.