PCNE Configuring Network Services Practice Question
A company wants to securely connect an on-premises data center to a VPC in us-central1. The on-premises network uses RFC 1918 addresses (10.0.0.0/8) that overlap with the VPC subnet (10.0.1.0/24). They need connectivity to specific workloads in the VPC without changing IP addresses on premises. What should they do?
⚠ Common exam trap
Many candidates assume BGP or more specific prefixes can overcome IP overlap, but without NAT or a proxy mechanism, overlapping routes cause routing conflicts that break connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Private Service Connect to expose the VPC workloads as endpoints accessible from on-premises.
Private Service Connect (PSC) allows on-premises clients to access specific VPC workloads via internal IP addresses (RFC 1918) without requiring VPC peering or VPN. PSC publishes the workloads as endpoints reachable through a Private Service Connect endpoint in the on-premises network, avoiding IP overlap by using a separate IP address range for the endpoint. This solution meets the requirement of not changing on-premises IPs while providing secure, targeted connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use VPC Network Peering with a custom route exchange to filter the overlapping range.
Why it's wrong here
Peering does not allow overlapping CIDR ranges.
- ✗
Set up Dedicated Interconnect and configure BGP with the on-premises router, advertising a more specific prefix.
Why it's wrong here
Interconnect cannot resolve overlapping IPs; routes would conflict.
- ✗
Use Cloud NAT and configure a firewall rule to allow traffic from the on-premises network.
Why it's wrong here
Cloud NAT is only for outbound traffic from VMs; it doesn't provide inbound connectivity.
- ✓
Deploy Private Service Connect to expose the VPC workloads as endpoints accessible from on-premises.
Why this is correct
Private Service Connect allows private connectivity without route overlap by using service attachments and endpoints.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.