PCNE Implementing a Virtual Private Cloud Practice Question
A company has an on-premises data center connected to Google Cloud via Dedicated Interconnect. They have a VPC with subnets in us-central1 and us-west1. They want compute instances in us-central1 to access Google APIs (e.g., Cloud Storage) without traversing the internet, but the on-premises network must also be able to access those APIs via the interconnect. They have configured Private Google Access (PGA) on all subnets. However, on-premises users report that they cannot access Cloud Storage buckets using the private IP of a forward proxy in us-central1 (the proxy is configured to use the default internet gateway for egress). What is the most likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is a custom static route for 199.36.153.4/30 (Google API VIP) that points to the interconnect, overriding the default route for the proxy's outbound traffic.
Private Google Access (PGA) allows instances with only internal IPs to reach Google APIs via the default internet gateway (0.0.0.0/0 route). However, if a more specific static route exists for the Google API IP range (199.36.153.4/30) that points to the interconnect, traffic from the forward proxy to Google APIs will be routed to the on-premises network instead of the internet. Since the proxy is in us-central1 and uses its VPC routing, the custom route overrides the default route, preventing the proxy from reaching Google APIs. Option C correctly identifies this misconfiguration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Private Google Access is not supported on subnets in us-central1.
Why it's wrong here
PGA is supported on all subnets.
- ✗
The forward proxy must use an external IP address to use Private Google Access.
Why it's wrong here
PGA is designed for instances without external IPs.
- ✓
There is a custom static route for 199.36.153.4/30 (Google API VIP) that points to the interconnect, overriding the default route for the proxy's outbound traffic.
Why this is correct
A custom route for the Google API VIP would cause the proxy to route traffic to on-premises instead of using the internet gateway, breaking PGA for the proxy.
- ✗
The on-premises network must be configured with a default route pointing to the internet.
Why it's wrong here
On-premises routing is irrelevant; the issue is on the proxy's VPC routing.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.