PCNE Configuring Network Services Practice Question
A company is migrating on-premises services to Google Cloud. They have a hybrid connectivity NEG that points to an on-premises endpoint via a Cloud VPN tunnel. The Traffic Director service mesh is configured to route traffic to that NEG. However, traffic to the on-premises service is failing with connection timeouts. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The on-premises firewall is blocking health check probes from Google Cloud
Hybrid connectivity NEGs require that the on-premises endpoint is reachable via a Cloud VPN or Interconnect. If Traffic Director cannot reach the endpoint, it might be due to missing firewall rules allowing health check probes or the NEG endpoint being misconfigured. The most common cause is that health checks are failing because the firewall rules on-premises are not allowing the health check source ranges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The hybrid connectivity NEG is not supported with Traffic Director
Why it's wrong here
Hybrid connectivity NEGs are supported with Traffic Director for on-prem backends.
- ✗
The Cloud VPN tunnel is not established
Why it's wrong here
If the tunnel were down, connectivity would fail, but the question says the NEG is configured; a down tunnel would be a broader issue, but the most likely specific cause is health check blocking.
- ✗
Traffic Director requires mTLS for all hybrid endpoints
Why it's wrong here
mTLS is optional; Traffic Director can route to hybrid endpoints without mTLS.
- ✓
The on-premises firewall is blocking health check probes from Google Cloud
Why this is correct
Health checks from Google Cloud must be allowed; if blocked, the NEG is marked unhealthy and traffic is not sent.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.