PCNE Practice Question: Designing, Planning, and Prototyping a GCP Network

Exhibit

gcloud compute networks subnets describe my-subnet --region us-central1
- name: my-subnet
- network: my-vpc
- ipCidrRange: 10.0.1.0/24
- privateIpGoogleAccess: true
- purpose: PRIVATE
- logConfig: {enable: true}

Refer to the exhibit. A company has enabled Private Google Access on the subnet. What effect does this have on VMs in the subnet?

⚠ Common exam trap

Google Cloud often tests the misconception that Private Google Access provides general internet access (like Cloud NAT) or that it requires VMs to have external IPs, when in fact it is strictly for Google APIs and services using internal-only VMs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

VMs can access Google services using only internal IPs

Private Google Access enables VMs in a subnet that have only internal IP addresses (RFC 1918) to reach Google APIs and services (e.g., Cloud Storage, BigQuery) through Google's internal network. The traffic is routed via the default internet gateway (which does not require an external IP on the VM) and uses a special 0.0.0.0/0 route with next hop 'default internet gateway' to reach Google's external IPs, but the VM itself never needs a public IP. This is why D is correct: VMs can access Google services using only internal IPs.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
VMs can use external IPs to access Google services
Why it's wrong here
Private Google Access means VMs can access services without external IPs.
✗
VMs can access the internet using Cloud NAT
Why it's wrong here
Private Google Access does not provide general internet access.
✗
VMs can communicate with each other without firewall rules
Why it's wrong here
VM-to-VM communication still requires firewall rules.
✓
VMs can access Google services using only internal IPs
Why this is correct
Private Google Access enables access to Google APIs over internal IPs.

Visual reference

Go deeper

PCNE Practice Question: Designing, Planning, and Prototyping a GCP Network

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question