PCNE Implementing a Virtual Private Cloud Practice Question
A company has an HA VPN tunnel between on-premises and Google Cloud. They want traffic destined to 10.1.0.0/16 (a subnet in their VPC) to go through a specific next-hop VPN tunnel interface, but currently traffic is being dropped. What should they verify?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC has a custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface.
A custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface is required to force traffic to go through that specific tunnel. Option B is incorrect because Cloud NAT is for outbound internet access, not routing to on-premises. Option C is incorrect because firewall rules control access but not routing. Option D is incorrect because on-premises BGP advertisement is for routes from on-premises to Google Cloud, not for directing traffic within Google Cloud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The VPC has a custom route with destination 10.1.0.0/16 and next-hop set to the correct VPN tunnel interface.
Why this is correct
Correct. A custom route with the correct next-hop VPN tunnel interface ensures traffic to 10.1.0.0/16 goes through the intended tunnel.
- ✗
Cloud NAT is enabled.
Why it's wrong here
Incorrect. Cloud NAT provides outbound internet access for private instances, not routing to on-premises networks.
- ✗
Firewall rules allow ingress from on-premises IPs.
Why it's wrong here
Incorrect. Firewall rules control what traffic is allowed, but they do not determine the path packets take; routing does.
- ✗
The on-premises router is advertising the route via BGP.
Why it's wrong here
Incorrect. On-premises BGP advertisement is used for importing routes into Cloud Router, but the route for 10.1.0.0/16 is a Google Cloud VPC route that must be configured manually or via BGP from the on-premises side if learned.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.