PCNE Implementing a Virtual Private Cloud Practice Question
A network engineer is troubleshooting connectivity from a VM to an on-premises server over a Cloud VPN. The VM can reach the on-premises server, but the return traffic is dropped. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The on-premises network does not have a route back to the VPC subnet.
The most likely cause is that the on-premises network lacks a route back to the VPC subnet. For Cloud VPN, return traffic from the on-premises server must have a route pointing to the on-premises VPN gateway to reach the VM. Without this route, packets are dropped, causing asymmetric routing. Option B is incorrect because firewall rules affect all traffic, not just the return path. Option C is incorrect because if the BGP session were down, no connectivity would exist at all. Option D is incorrect because Cloud Router is used for dynamic routing, but a missing return route would still cause the issue even with static routes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The on-premises network does not have a route back to the VPC subnet.
Why this is correct
Return traffic requires a route on-premises pointing to the VPN gateway.
- ✗
A firewall rule is blocking ingress traffic from the on-premises network.
Why it's wrong here
Firewall rules would block all traffic, not just return.
- ✗
The BGP session is down.
Why it's wrong here
If BGP session is down, no routes are exchanged, so no connectivity.
- ✗
The Cloud Router is not configured.
Why it's wrong here
Cloud Router is needed for BGP, but static routes can be used; missing Cloud Router does not cause asymmetric drop.
Visual reference
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.