A regional network address translation service that lets VMs and GKE nodes with only internal IPs start connections to the internet without accepting unsolicited inbound connections. It is configured on a Cloud Router.
On the ACE it is the answer to "VMs without external IPs that must download updates". It does not replace Private Google Access, the recommended path to Google APIs.
Cloud NAT is a concept that can show up on the exam. Check the full guide to see it in context.