PROFESSIONAL-CLOUD-NETWORK-ENGINEER Question #195: Real Exam Question with Answer & Explanation

Question

You are implementing a VPC architecture for your organization by using a Network Connectivity Center hub and spoke topology: - There is one Network Connectivity Center hybrid spoke to receive on- premises routes. - There is one VPC spoke that needs to be added as a Network Connectivity Center spoke. Your organization has limited routable IP space for their cloud environment (192.168.0.0/20). The Network Connectivity Center spoke VPC is connected to on-premises with a Cloud Interconnect connection in the us-east4 region. The on-premises IP range is 172.16.0.0/16. You need to reach on-premises resources from multiple Google Cloud regions (us-west1,europe-central1, and asia- southeast1) and minimize the IP addresses being used. What should you do?

Options

• A1. Configure a Private NAT gateway and NAT subnet in us-west1(192.168.1.0/24), europe-
• B1. Configure a Private NAT gateway instance in us-west1(172.16.1.0/24), europe-
• C1. Configure a Private NAT gateway instance in us-east4(192.168.1.0/24).
• D1. Configure a Private NAT gateway instance in us-west1(192.168.1.0/24), europe-

Explanation

Option A is correct because Private NAT on Google Cloud requires both a NAT gateway and a dedicated NAT subnet, and you must deploy them in each region where traffic originates (us-west1, europe-central1, asia-southeast1) - not just at the Interconnect endpoint. Using 192.168.x.x subnets keeps the NAT addresses within the organization's allocated cloud space (192.168.0.0/20), avoiding conflicts with the on-premises range.

Option B is wrong because it uses 172.16.x.x addresses for the NAT subnets - that's the on-premises range (172.16.0.0/16), which would cause routing conflicts and defeat the purpose of NAT.

Option C is wrong because it only places a NAT gateway in us-east4 (where the Interconnect lives), but traffic from the other three regions still lacks a NAT translation point; the NCC hub doesn't automatically apply NAT to traffic routed through it.

Option D is wrong because Private NAT requires a dedicated NAT subnet in addition to the gateway - configuring a gateway instance alone without the subnet is an incomplete configuration that won't function.

Memory tip: Think "Private NAT = Gateway + Subnet, your CIDR, every SOURCE region." The gateway translates; the subnet provides the NAT pool - both must be in the cloud address space and co-located with the traffic origin.

No community discussion yet for this question.