- A
Create a separate subnet for each service project in the Shared VPC and enable Private Google Access only on the Prod subnet.
Why wrong: Additional subnets waste IP address space and increase complexity; all projects can share the same subnet.
- B
Enable Private Google Access on the Shared VPC's subnet for all projects and configure Cloud Router with BGP to advertise a default route.
Why wrong: Private Google Access is already enabled for the whole subnet; BGP advertisement of default route doesn't help because VMs without external IPs still cannot reach the internet directly.
- C
Configure Cloud NAT in the Shared VPC for the Staging and Dev service projects to allow outbound internet access from their VMs without external IPs.
Cloud NAT provides internet access to VMs without external IPs; Private Google Access remains enabled for Prod. This is cost-effective because Cloud NAT shares IPs across multiple VMs.
- D
Disable Private Google Access on the subnet and create a separate subnet for Prod with Private Google Access enabled.
Why wrong: Disabling Private Google Access would break Prod's requirement; creating separate subnet increases IP consumption and management overhead.
Quick Answer
The most cost-effective solution is to configure Cloud NAT in the Shared VPC for the Staging and Dev service projects, because Cloud NAT provides outbound internet access for VM instances without external IP addresses, while Private Google Access already handles Google API access for the Prod project. Private Google Access enables VMs without external IPs to reach Google APIs and services using internal IP addresses, but it does not provide general internet connectivity; Cloud NAT fills that gap by translating private IPs to a single public IP for outbound traffic. On the Google Professional Cloud Network Engineer exam, this scenario tests your understanding of how Shared VPCs separate network responsibilities—Private Google Access is a subnet-level setting, while Cloud NAT is a regional resource that can be applied per service project. A common trap is assuming Private Google Access also grants internet access, but it only covers Google APIs and services. Remember the mnemonic: “Private for Google, NAT for the rest.”
PCNE Practice Question: Designing, planning, and prototyping a GCP network
This PCNE practice question tests your understanding of designing, planning, and prototyping a gcp network. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses a Shared VPC host project with three service projects: Prod, Staging, and Dev. All service projects have similar network requirements except that Prod requires Private Google Access to access Google APIs from VM instances without external IP addresses. The network team creates a single subnet in the Shared VPC with Private Google Access enabled. However, Staging and Dev teams report that their VMs cannot reach external IP addresses on the internet because the subnet's route has a next hop of default internet gateway. What is the most cost-effective solution that meets all requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Configure Cloud NAT in the Shared VPC for the Staging and Dev service projects to allow outbound internet access from their VMs without external IPs.
Option C is correct because Cloud NAT provides outbound internet connectivity for VM instances without external IP addresses, which is exactly what Staging and Dev need. Since Private Google Access is already enabled on the shared subnet, Prod VMs can reach Google APIs without external IPs, while Cloud NAT handles the general internet access for the other projects. This is the most cost-effective solution because Cloud NAT incurs only egress data processing charges and does not require additional subnets or complex routing changes.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a separate subnet for each service project in the Shared VPC and enable Private Google Access only on the Prod subnet.
Why it's wrong here
Additional subnets waste IP address space and increase complexity; all projects can share the same subnet.
- ✗
Enable Private Google Access on the Shared VPC's subnet for all projects and configure Cloud Router with BGP to advertise a default route.
Why it's wrong here
Private Google Access is already enabled for the whole subnet; BGP advertisement of default route doesn't help because VMs without external IPs still cannot reach the internet directly.
- ✓
Configure Cloud NAT in the Shared VPC for the Staging and Dev service projects to allow outbound internet access from their VMs without external IPs.
- ✗
Disable Private Google Access on the subnet and create a separate subnet for Prod with Private Google Access enabled.
Why it's wrong here
Disabling Private Google Access would break Prod's requirement; creating separate subnet increases IP consumption and management overhead.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse Private Google Access with general internet access, assuming that enabling it on a subnet automatically allows VMs to reach any external IP, when in fact Private Google Access only covers Google API and service endpoints, not arbitrary internet destinations.
Detailed technical explanation
How to think about this question
Private Google Access uses the subnet's default route (0.0.0.0/0) with a next hop to the default internet gateway to reach Google APIs' external IPs, but it does not provide general internet access. Cloud NAT uses the same default route but performs source network address translation (SNAT) for outbound connections, allowing VMs without external IPs to reach the internet. Under the hood, Cloud NAT allocates ephemeral external IPs from a pool and translates VM private IPs to those public IPs, which is more cost-effective than assigning static external IPs to each VM.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A startup's cloud architect reviews their monthly bill and notices costs are higher than expected for a long-running batch job. Switching from on-demand instances to Reserved Instances — or using Spot/Preemptible VMs — can reduce compute costs by up to 72 %. Questions like this test whether you understand the tradeoffs between commitment, flexibility, and cost across cloud pricing models.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Designing, planning, and prototyping a GCP network — study guide chapter
Learn the concepts, then practise the questions
- →
Designing, planning, and prototyping a GCP network practice questions
Targeted practice on this topic area only
- →
All PCNE questions
497 questions across all exam domains
- →
Google Professional Cloud Network Engineer study guide
Full concept coverage aligned to exam objectives
- →
PCNE practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related PCNE practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Designing, planning, and prototyping a GCP network practice questions
Practise PCNE questions linked to Designing, planning, and prototyping a GCP network.
Implementing hybrid interconnectivity practice questions
Practise PCNE questions linked to Implementing hybrid interconnectivity.
Configuring network services practice questions
Practise PCNE questions linked to Configuring network services.
Implementing network security practice questions
Practise PCNE questions linked to Implementing network security.
Implementing a Virtual Private Cloud practice questions
Practise PCNE questions linked to Implementing a Virtual Private Cloud.
PCNE fundamentals practice questions
Practise PCNE questions linked to PCNE fundamentals.
PCNE scenario practice questions
Practise PCNE questions linked to PCNE scenario.
PCNE troubleshooting practice questions
Practise PCNE questions linked to PCNE troubleshooting.
Practice this exam
Start a free PCNE practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this PCNE question test?
Designing, planning, and prototyping a GCP network — This question tests Designing, planning, and prototyping a GCP network — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Configure Cloud NAT in the Shared VPC for the Staging and Dev service projects to allow outbound internet access from their VMs without external IPs. — Option C is correct because Cloud NAT provides outbound internet connectivity for VM instances without external IP addresses, which is exactly what Staging and Dev need. Since Private Google Access is already enabled on the shared subnet, Prod VMs can reach Google APIs without external IPs, while Cloud NAT handles the general internet access for the other projects. This is the most cost-effective solution because Cloud NAT incurs only egress data processing charges and does not require additional subnets or complex routing changes.
What should I do if I get this PCNE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on PCNE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network engineer is troubleshooting connectivity from a Compute Engine instance in subnet-a to a Google Cloud Storage bucket. The instance has no external IP address. Based on the exhibit, what is the most likely cause of the connectivity issue?
hard- A.The subnet purpose is PRIVATE, which blocks Google APIs.
- ✓ B.Private Google Access is disabled on the subnet.
- C.The subnet CIDR range is too small.
- D.Flow logs are disabled, so traffic is not logged.
Why B: The instance has no external IP address, so it must use Private Google Access to reach Google APIs and services like Cloud Storage. Private Google Access is enabled at the subnet level; if it is disabled, the instance cannot route traffic to the Google API VIPs through the default route (0.0.0.0/0) without a NAT gateway or external IP. Option B correctly identifies this as the most likely cause.
Variation 2. A team is deploying a new service in a Compute Engine instance without an external IP in subnet-b. The service needs to access Google Cloud Storage using internal IPs. What must the team do to enable this?
medium- A.Assign an external IP address to the instance.
- B.Move the instance to subnet-a where Private Google Access is already enabled.
- ✓ C.Enable Private Google Access on subnet-b.
- D.Set up Cloud NAT on the VPC to allow outbound access to Google APIs.
Why C: Private Google Access enables a Compute Engine instance without an external IP address to reach Google APIs and services (including Cloud Storage) over the internal VPC network using RFC 1918 addresses. By enabling this feature on subnet-b, the instance can access Cloud Storage via internal IPs without needing an external IP or NAT gateway. This is the correct and minimal configuration for the requirement.
Last reviewed: Jun 24, 2026
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.