PCNE Implementing Hybrid Interconnectivity Practice Question
A company wants to use a third-party VPN appliance on Google Cloud (Compute Engine) to connect to an on-premises network. Which networking feature must be enabled to allow the VPN appliance to forward traffic between VPC subnets and the tunnel?
⚠ Common exam trap
Google Cloud often tests the distinction between network-level configurations (routes, firewall rules) and instance-level capabilities (IP forwarding), trapping candidates who assume that creating a route or firewall rule alone is sufficient for a VM to act as a gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable IP forwarding on the VPN appliance VM instance.
A third-party VPN appliance running as a Compute Engine VM must have IP forwarding enabled to act as a router. Without this setting, the VM will drop any traffic that is not destined to its own IP address, even if the kernel is configured to forward packets. Enabling IP forwarding (via the `canIpForward` flag or the `gcloud compute instances create --can-ip-forward` option) allows the VM to forward traffic between the VPC subnets and the VPN tunnel interfaces.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a custom route in the VPC pointing to the VPN appliance's internal IP.
Why it's wrong here
While a route is needed, IP forwarding is the prerequisite; the route alone won't work without it.
- ✗
Enable Private Google Access on the subnet hosting the VPN appliance.
Why it's wrong here
Private Google Access is unrelated to VPN forwarding.
- ✓
Enable IP forwarding on the VPN appliance VM instance.
Why this is correct
IP forwarding is required for the VM to act as a router.
- ✗
Create a firewall rule allowing traffic from the on-premises network to the VPC subnets.
Why it's wrong here
Firewall rules are needed but not the primary enabler for forwarding.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.