mediumMultiple ChoiceObjective-mapped
PCSE Practice Question: Your organization uses Shared VPC with a host…
Your organization uses Shared VPC with a host project and several service projects. You need to ensure that all egress traffic from Compute Engine instances in a service project is routed through a centralized Cloud NAT in the host project. What is the required configuration?
⚠ Common exam trap
Google Cloud often tests the misconception that a Cloud NAT must be configured in the same project as the instances, but in Shared VPC, the NAT is configured in the host project for the shared subnet, and service project instances automatically use it without any additional configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Cloud NAT on the Cloud Router in the host project for the subnet that is shared with the service project
A Cloud NAT configured on the Cloud Router in the host project for the shared subnet allows all Compute Engine instances in service projects attached to that subnet to use the host project's NAT IP for outbound traffic. This is the only way to centralize egress traffic through the host project's Cloud NAT while respecting Shared VPC architecture, as the NAT is tied to the subnet and Cloud Router in the host project.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a firewall rule in the host project that denies all egress traffic except to the Cloud NAT IP
Why it's wrong here
Firewall rules cannot force traffic through NAT; they only allow/deny. NAT is configured on Cloud Router.
- ✗
Set the instances to use a custom route with next-hop as the Cloud NAT IP address
Why it's wrong here
Cloud NAT is not a next-hop; it's a function of Cloud Router. Custom routes cannot point to a NAT IP.
- ✓
Configure a Cloud NAT on the Cloud Router in the host project for the subnet that is shared with the service project
Why this is correct
Correct: In Shared VPC, the host project owns the subnets. Cloud NAT on the host project's router for those subnets will handle egress for all instances in those subnets, including those from service projects.
- ✗
Configure a Cloud NAT in each service project and associate it with the subnet that the instances use
Why it's wrong here
This would create separate NATs, not centralized. The goal is a single NAT in the host project.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCSE question from scratch — 960 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.