You are implementing a VPC architecture for your organization by using a Network Connectivity Center hub and spoke topology: - There is one Network Connectivity Center hybrid spoke to receive on…

Question

Options

• A
  1. Configure a Private NAT gateway and NAT subnet in us-west1(192.168.1.0/24), europe-
• B
  1. Configure a Private NAT gateway instance in us-west1(172.16.1.0/24), europe-
• C
  1. Configure a Private NAT gateway instance in us-east4(192.168.1.0/24).
• D
  1. Configure a Private NAT gateway instance in us-west1(192.168.1.0/24), europe-

• A
  49% (27)
• B
  7% (4)
• C
  13% (7)
• D
  31% (17)

Explanation

Option A is correct because Private NAT on Google Cloud requires both a NAT gateway and a dedicated NAT subnet, and you must deploy them in each region where traffic originates (us-west1, europe-central1, asia-southeast1) - not just at the Interconnect endpoint. Using 192.168.x.x subnets keeps the NAT addresses within the organization's allocated cloud space (192.168.0.0/20), avoiding conflicts with the on-premises range.

Option B is wrong because it uses 172.16.x.x addresses for the NAT subnets - that's the on-premises range (172.16.0.0/16), which would cause routing conflicts and defeat the purpose of NAT.

Option C is wrong because it only places a NAT gateway in us-east4 (where the Interconnect lives), but traffic from the other three regions still lacks a NAT translation point; the NCC hub doesn't automatically apply NAT to traffic routed through it.

Option D is wrong because Private NAT requires a dedicated NAT subnet in addition to the gateway - configuring a gateway instance alone without the subnet is an incomplete configuration that won't function.

Memory tip: Think "Private NAT = Gateway + Subnet, your CIDR, every SOURCE region." The gateway translates; the subnet provides the NAT pool - both must be in the cloud address space and co-located with the traffic origin.

No community discussion yet for this question.