PCNE Implementing a Virtual Private Cloud Practice Question
A company is deploying a multi-tier web application on Google Cloud. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier must not have any public IP addresses. Which VPC design should be used?
⚠ Common exam trap
Google Cloud often tests the misconception that firewall rules alone can prevent public IP assignment, but the trap here is that firewall rules control traffic, not the existence of a public IP address on a resource; the database tier must have no public IP at all, which requires a VPC design that prohibits internet gateway routes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use three separate VPCs for each tier and connect them using VPC peering.
Using three separate VPCs with VPC peering enforces strict network segmentation: the web tier VPC has a public subnet with an internet gateway, the application tier VPC is peered only to the web tier VPC (no internet gateway), and the database tier VPC is peered only to the application tier VPC (no public IPs). This design ensures that the database tier has no public IP addresses and is only reachable through the application tier, meeting all security requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a Shared VPC with separate subnets in different projects for each tier.
Why it's wrong here
Shared VPC is for multi-project environments, not for tier isolation within one organization.
- ✓
Use three separate VPCs for each tier and connect them using VPC peering.
Why this is correct
Separate VPCs provide full isolation; peering allows controlled communication.
- ✗
Use a single VPC and connect the database tier via Cloud VPN to on-premises.
Why it's wrong here
Cloud VPN does not address isolation between tiers within a VPC.
- ✗
Use a single VPC with separate subnets for each tier and configure firewall rules to restrict traffic.
Why it's wrong here
Single VPC does not provide network isolation at the VPC level; firewall rules alone can be misconfigured.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.