Question 971 of 961
Cloud DNS Private Zone Across Peered VPCs: Resolution Permissions
A company has two VPC networks in the same project: Network A (hosting a private zone for 'example.internal.') and Network B. They are connected via VPC peering. The network engineer created a DNS peering zone in Network B for 'example.internal.' pointing to Network A. However, instances in Network B cannot resolve 'host.example.internal.' which is defined in Network A's private zone. The engineer verified that the peering zone is active and the networks are properly peered. What is the most likely reason for the resolution failure?
Quick Answer
The answer is that the private zone in Network A is not configured to allow resolution from peered networks. This is the most likely reason for the resolution failure because Cloud DNS private zones operate with an explicit opt-in for cross-network visibility; even with VPC peering and a DNS peering zone established in Network B, the source zone in Network A must have its "Allow resolution from peered networks" setting enabled to accept queries from the peered VPC. On the Google Professional Cloud Network Engineer exam, this scenario tests your understanding that DNS peering zones are directional and that the private zone’s visibility is a separate permission from the peering connection itself—a common trap is assuming that active peering alone grants DNS resolution. Remember the mnemonic "Peering is for traffic, permission is for queries": VPC peering handles network traffic, but DNS resolution across peered VPCs requires explicitly enabling that permission on the private zone.
⚠ Common exam trap
Google Cloud often tests the distinction between VPC peering connectivity and DNS resolution permissions, trapping candidates who assume that active VPC peering and a DNS peering zone are sufficient without checking the private zone's peering settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The private zone in Network A is not configured to allow resolution from peered networks.
Cloud DNS private zones do not automatically allow resolution from peered VPC networks unless explicitly configured. Even though VPC peering and DNS peering are active, the private zone in Network A must have its 'Allow resolution from peered networks' setting enabled. Without this, queries from Network B via the DNS peering zone are rejected, causing resolution failures for records like 'host.example.internal.'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An inbound server policy must be created in Network A.
Why it's wrong here
Inbound server policies are for on-premises DNS resolvers to query Cloud DNS.
- ✗
The peering zone should be a forwarding zone instead.
Why it's wrong here
A peering zone is the correct choice; a forwarding zone requires an IP address of a DNS server, which is not the case here.
- ✗
An outbound server policy must be created in Network B.
Why it's wrong here
Outbound server policies allow VPC instances to forward queries to on-premises DNS, not the other way.
- ✓
The private zone in Network A is not configured to allow resolution from peered networks.
Why this is correct
Private zones must explicitly list which VPC networks can query them via peering.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A DNS managed zone is configured with private visibility and associated with a VPC network. A Compute Engine instance in a different VPC network tries to resolve 'test.example.com' but fails. What is the most likely reason?
medium- A.The zone is not set as authoritative for example.com.
- B.The Cloud DNS name servers are not reachable from the instance.
- ✓ C.The instance's VPC is not in the list of authorized networks.
- D.The instance does not have the required IAM permissions.
Why C: Private zones only respond to queries from authorized VPC networks. The instance is in a different VPC, so resolution fails.
Last reviewed: Jun 30, 2026
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.