PCNE Implementing a Virtual Private Cloud Practice Question
A company has a VPC with a single subnet in us-central1 (10.0.0.0/24). They have a Compute Engine instance running a database that uses an internal IP address 10.0.0.10. They need to ensure that this database instance can be accessed by a legacy on-premises application via a Cloud VPN tunnel. The on-premises network uses 192.168.0.0/16. They have set up a HA VPN gateway with two tunnels and BGP routing. The Cloud Router is configured to advertise the subnet 10.0.0.0/24. On the on-premises side, the router receives the route for 10.0.0.0/24 and has a static route for 10.0.0.0/24 pointing to the VPN tunnel. However, the on-premises application cannot reach the database. The application's server can ping the on-premises gateway, but not the database IP. The database instance's OS firewall allows all traffic from 0.0.0.0/0. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC firewall rules are blocking ingress from on-premises; add a rule allowing traffic from 192.168.0.0/16 to the database IP.
The issue is likely that the VPC firewall rules are blocking ingress traffic from the on-premises network. Even though the database OS firewall is permissive, the VPC firewall must allow ingress from the on-premises IP range (192.168.0.0/16) to the database's IP. Option B is correct: Create a firewall rule allowing ingress from 192.168.0.0/16 to 10.0.0.10 on the required port.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The database instance's OS firewall is blocking the traffic despite the setting.
Why it's wrong here
The OS firewall is set to allow all, so it is not the issue.
- ✓
The VPC firewall rules are blocking ingress from on-premises; add a rule allowing traffic from 192.168.0.0/16 to the database IP.
Why this is correct
By default, VPC firewall denies ingress; an explicit allow rule is needed.
- ✗
The Cloud Router is not advertising the specific database IP 10.0.0.10, only the subnet 10.0.0.0/24.
Why it's wrong here
Advertising the subnet is sufficient; the on-premises router will route to the entire subnet.
- ✗
The BGP session is not establishing properly; check the shared secret and IP addresses.
Why it's wrong here
The on-premises router received the route, so BGP is working.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An engineer is troubleshooting connectivity between an on-premises network and a GCP VPC over a Cloud VPN tunnel with dynamic routing (BGP). The tunnel is established and BGP session is up, but on-premises hosts cannot reach instances in the VPC. What should the engineer check first?
medium- A.The advertised route from the on-premises router is a default route.
- B.The MTU size of the VPN tunnel.
- C.The Cloud VPN gateway is assigned an external IP address.
- ✓ D.The firewall rules in the VPC allowing incoming traffic from the on-premises CIDR.
Why D: The first thing to check is the VPC firewall rules because even if BGP routes are exchanged and the tunnel is up, traffic can be blocked by firewall rules if there is no ingress rule allowing traffic from the on-premises CIDR. The tunnel being established and BGP session up indicates Layer 3 connectivity, but Layer 4 filtering via firewall rules can still block traffic. Option A is incorrect: a default route advertised from on-premises is fine as long as the route is learned and points to the correct next hop. Option B is incorrect: MTU issues would typically cause fragmentation problems, not complete inability to reach instances. Option C is incorrect: the Cloud VPN gateway must have an external IP for the tunnel to be established; if it were missing, the tunnel wouldn't be up.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.