Question 940 of 960
hardMultiple ChoiceObjective-mapped
Private Google Access: Default Route to Internet Gateway Required
You are a security engineer for a financial services company that processes sensitive customer data. Your architecture includes two VPCs: 'data-vpc' (10.1.0.0/16) containing BigQuery datasets and Cloud Storage buckets, and 'app-vpc' (10.2.0.0/16) containing Compute Engine instances running a customer-facing application. The application needs to read from BigQuery and write to Cloud Storage. You have configured VPC Network Peering between the VPCs. Additionally, you have set up Private Google Access on all subnets in 'data-vpc' and 'app-vpc'. The application instances cannot connect to BigQuery or Cloud Storage. You have verified that firewall rules allow egress traffic to the Google APIs IP range (199.36.153.4/30) and that DNS resolution works correctly. What is the most likely cause of the connectivity failure?
Quick Answer
The answer is that the app-vpc subnets lack a default route (0.0.0.0/0) to the internet gateway. Private Google Access enables on-premises or VM instances to reach Google APIs using internal IP addresses, but it still requires a default route pointing to the internet gateway in the VPC where the Compute Engine instances reside. Without this route, traffic destined for the Google API IP range (199.36.153.4/30) cannot be forwarded out to the internet gateway, even though Private Google Access is enabled on the subnet and firewall rules allow egress. On the Google Professional Cloud Security Engineer exam, this is a classic trap: candidates often assume that enabling Private Google Access alone is sufficient, forgetting that the underlying routing path must exist. The exam tests your understanding that Private Google Access is a subnet-level configuration that works in conjunction with, not as a replacement for, a default route. Memory tip: think of Private Google Access as the "permission" and the default route as the "road"—without the road, the permission gets you nowhere.
⚠ Common exam trap
Google Cloud often tests the misconception that Private Google Access works independently of routing, but the trap here is that candidates overlook the requirement for a default route (0.0.0.0/0) to the internet gateway, even when Private Google Access is enabled on the subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'app-vpc' subnets do not have a default route (0.0.0.0/0) to the internet gateway.
Private Google Access requires a default route (0.0.0.0/0) to the internet gateway in the VPC where the Compute Engine instances reside. Without this route, traffic destined for Google APIs (including BigQuery and Cloud Storage) cannot be forwarded to the internet gateway, even if Private Google Access is enabled on the subnet. The firewall rules and DNS are correctly configured, but the missing default route prevents the egress traffic from reaching the Google API IP range (199.36.153.4/30).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VPC Network Peering does not support Private Google Access.
Why it's wrong here
Private Google Access works over VPC Peering if the subnet has a route to the internet.
- ✗
Cloud NAT is not configured for 'app-vpc'.
Why it's wrong here
Cloud NAT is not required for Private Google Access; it's for connections to the internet without external IPs.
- ✓
The 'app-vpc' subnets do not have a default route (0.0.0.0/0) to the internet gateway.
Why this is correct
Private Google Access requires a default route for traffic to be sent to the internet gateway.
- ✗
Firewall rules are blocking traffic to the Google APIs IP range.
Why it's wrong here
Firewall rules were verified to allow egress to 199.36.153.4/30.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a VPC with subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They enabled Private Google Access on subnet-a. Instances in subnet-a can access Google APIs and services using private IPs. However, instances in subnet-b cannot reach Google APIs even though subnet-b has a default route to the internet through a NAT gateway. What is the likely cause?
medium- A.Subnet-b does not have a default route to the internet.
- B.Cloud NAT is not configured for subnet-b.
- C.Firewall rules are blocking traffic to googleapis.com.
- ✓ D.Private Google Access is not enabled on subnet-b.
Why D: Private Google Access is a per-subnet setting that allows instances with only private IPs to reach Google APIs and services through the VPC's default internet gateway, without needing public IPs or NAT. Since subnet-b does not have Private Google Access enabled, its instances cannot use this feature even though they have a default route to the internet via a NAT gateway; the NAT gateway only provides outbound internet access for public IP destinations, not the private IP ranges used by Google APIs.
Last reviewed: Jun 30, 2026
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.