PCNE Global VPC Practice Question
A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)
⚠ Common exam trap
Candidates may assume that cross-region communication requires additional connectivity like VPC peering or VPN, but Google Cloud's global VPC allows instances in different regions to communicate privately by default using internal IPs. The real trap is forgetting that firewall rules must allow the traffic, not that a Layer 3 connection is needed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create firewall rules allowing all traffic from the other region's subnet CIDR.
In Google Cloud, a VPC is a global resource. Subnets are regional, but they all belong to the same VPC. Instances in different regions within the same VPC can communicate using internal IP addresses automatically over Google's global network, without needing VPC peering, VPN, or Dedicated Interconnect. The only requirement is that firewall rules permit the traffic. Therefore, the necessary action is to create firewall rules (Option C). Options A and B are for connecting separate VPCs, which is not the scenario here. Options D and E are incorrect because using external IPs would traverse the internet, and Shared VPC is for sharing subnets across projects, not for connecting regions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set up VPC peering between the VPCs in each region.
Why it's wrong here
VPC peering is used to connect two separate VPCs. Since the scenario describes a single VPC with subnets in two regions, peering is not needed.
- ✗
Set up Cloud VPN or Dedicated Interconnect between the two VPCs.
Why it's wrong here
Cloud VPN or Dedicated Interconnect connects separate VPCs or on-premises networks. Within a single VPC, regional subnets already communicate privately without this.
- ✓
Create firewall rules allowing all traffic from the other region's subnet CIDR.
Why this is correct
Correct. Firewall rules are required to allow traffic between instances. By default, firewall rules may restrict traffic, so rules allowing the desired communication must be created.
- ✗
Configure instances to use external IP addresses for cross-region communication.
Why it's wrong here
Using external IPs would route traffic over the public internet, violating the requirement to communicate via internal IPs without traversing the internet.
- ✗
Use a shared VPC to connect both regions.
Why it's wrong here
Shared VPC allows sharing subnets across projects, not connecting regions within the same VPC. It does not affect cross-region communication within a single VPC.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.