The correct methods are Identity-Aware Proxy (IAP) TCP forwarding and a Cloud VPN tunnel, as both allow access to a private Compute Engine VM without requiring an external IP. IAP TCP forwarding works by tunneling SSH or RDP traffic through the IAP service using the `gcloud compute start-iap-tunnel` command, effectively making IAP the proxy that bridges your connection to the VM’s internal IP. A Cloud VPN tunnel, on the other hand, creates an encrypted IPsec connection between your on-premises network and the VPC, enabling on-premises hosts to reach the VM directly over its internal IP. On the Google Professional Cloud Network Engineer exam, this question tests your understanding of secure, IP-less access methods—a common trap is confusing IAP with bastion hosts or assuming a NAT gateway alone suffices. Remember the key distinction: IAP is for user-based, browser-driven access, while Cloud VPN is for site-to-site network connectivity. A useful memory tip is “IAP for people, VPN for pipes.”
PCNE Implementing network security Practice Question
This PCNE practice question tests your understanding of implementing network security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO of the following are valid methods to restrict access to a Compute Engine VM that has no external IP?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Cloud VPN tunnel from an on-premises network.
Option C is correct because a Cloud VPN tunnel creates an encrypted, RFC-compliant IPsec tunnel between an on-premises network and a VPC, allowing on-premises hosts to reach the VM over its internal IP without requiring an external IP on the VM. Option E is correct because Identity-Aware Proxy (IAP) TCP forwarding uses the IAP service as a proxy to establish an SSH or RDP connection to a VM that has no external IP, by tunneling traffic through the IAP service using the `gcloud compute start-iap-tunnel` command.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Using a NAT gateway to allow SSH from the internet.
This requires a bastion host with an external IP, not a direct method.
✓
A Cloud VPN tunnel from an on-premises network.
Why this is correct
VPN provides private connectivity from on-premises.
Related concept
Read the scenario before looking for a memorised answer.
✗
Assigning an external IP and using firewall rules.
Why it's wrong here
This defeats the no-external-IP requirement.
✓
Identity-Aware Proxy (IAP) TCP forwarding.
Why this is correct
IAP tunnels allow secure access without external IP.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the misconception that a NATgateway or a bastion host with a SOCKS proxy can provide inbound access to a private VM, when in fact NAT gateways only support outbound traffic and SOCKS proxies require the bastion to have an external IP and the VM to be reachable from the bastion, which does not satisfy the 'no external IP' constraint for the target VM itself.
Detailed technical explanation
How to think about this question
IAP TCP forwarding works by creating a secure tunnel through the IAP service, which authenticates the user via Cloud IAM and then proxies the connection to the VM's internal IP on port 22 (SSH) or 3389 (RDP). The VM must have the `roles/iap.tunnelResourceAccessor` IAM role and the `allow-ingress-from-iap` firewall rule that permits traffic from the IAP IP range (35.235.240.0/20) on the desired port. Cloud VPN uses IPsec with IKEv1 or IKEv2, and the VM's internal IP is routable over the VPN tunnel, enabling direct SSH without any external exposure.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Implementing network security — This question tests Implementing network security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: A Cloud VPN tunnel from an on-premises network. — Option C is correct because a Cloud VPN tunnel creates an encrypted, RFC-compliant IPsec tunnel between an on-premises network and a VPC, allowing on-premises hosts to reach the VM over its internal IP without requiring an external IP on the VM. Option E is correct because Identity-Aware Proxy (IAP) TCP forwarding uses the IAP service as a proxy to establish an SSH or RDP connection to a VM that has no external IP, by tunneling traffic through the IAP service using the `gcloud compute start-iap-tunnel` command.
What should I do if I get this PCNE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.