PCNE Implementing a Virtual Private Cloud Practice Question
A company has a VPC that is connected to an on-premises network via a Cloud VPN tunnel using dynamic routing (BGP). They have set up a Cloud Router with an advertised IP range of 10.0.0.0/8. The on-premises network advertises 172.16.0.0/12. They also have a custom static route in the VPC for 10.0.0.0/8 that points to a next-hop VPN tunnel (the same tunnel) with priority 100. Recently, they added a new subnet 10.1.0.0/24 in the VPC. Traffic from on-premises to 10.1.0.0/24 is not working. Which THREE steps should they take to troubleshoot and resolve the issue? (Choose 3.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the Cloud Router is advertising the 10.1.0.0/24 subnet to on-premises.
The issue is that traffic from on-premises to the new subnet 10.1.0.0/24 is not working. Since the VPC already has a Cloud VPN tunnel with dynamic routing (BGP) and a Cloud Router advertising 10.0.0.0/8, the new subnet 10.1.0.0/24 is more specific. Static routes with priority 100 for 10.0.0.0/8 do not override more specific dynamically learned routes; the most specific prefix wins. Therefore, the most likely causes are: the Cloud Router is not advertising the new subnet to on-premises (B), the on-premises firewall or route tables do not allow 10.1.0.0/24 (C), or the BGP session between Cloud Router and on-premises router is down (E). Checking BGP session status (E) is a fundamental step. Deleting the static route (D) is unnecessary, and changing priority (A) is not relevant because dynamic routes already have higher priority and more specific routes are preferred regardless. Thus, the correct steps are B, C, and E.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the static route priority to 1000 to match dynamic routes.
Why it's wrong here
Dynamic routes have priority 1000, so changing static to 1000 would not help; the static route would still have same priority but less specific dynamic route would win for more specific subnets? Actually, dynamic routes have a lower priority (higher number) than static, so dynamic routes are preferred. The issue is not priority but propagation.
- ✓
Verify that the Cloud Router is advertising the 10.1.0.0/24 subnet to on-premises.
Why this is correct
The Cloud Router may not automatically advertise new subnets unless configured to do so via custom advertisements.
- ✓
Verify that the new subnet's range is allowed in the on-premises firewall and route tables.
Why this is correct
The on-premises network may have routing or firewall rules preventing traffic to the new subnet.
- ✗
Delete the static route for 10.0.0.0/8 and rely solely on dynamic routing.
Why it's wrong here
While possible, it may break connectivity for other subnets in the range that are not advertised dynamically.
- ✓
Check the BGP session status between the Cloud Router and the on-premises router.
Why this is correct
The BGP session may be down, so no routes are exchanged.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.