PCNE Configuring Network Services Practice Question
Your company has deployed a hybrid cloud environment with a Cloud VPN tunnel between Google Cloud VPC and an on-premises data center. The VPC has a custom mode with subnet 10.0.1.0/24 in us-east1. On-premises uses subnet 192.168.1.0/24. The VPN tunnel is established using dynamic routing (BGP). Both sides advertise the correct prefixes. A Compute Engine VM in the VPC (10.0.1.10) can ping the on-premises gateway (192.168.1.1), but cannot ping a server on-premises (192.168.1.100). The on-premises network team confirms that 192.168.1.100 is reachable from the on-premises gateway. Firewall rules in GCP allow ingress from 192.168.1.0/24 to all VMs. What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the misconception that a successful ping to the remote gateway proves full bidirectional connectivity, but the trap here is that the gateway responds from its own IP stack, not from behind it, so a missing return route for the GCP subnet on the on-premises router breaks traffic to hosts beyond the gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The on-premises router does not have a route for the GCP subnet (10.0.1.0/24) pointing to the VPN tunnel.
Since the VM can ping the on-premises gateway (192.168.1.1) but not the server (192.168.1.100), the VPN tunnel and BGP session are working, and GCP has the correct route. The issue is that the on-premises router is not advertising or does not have a route for the GCP subnet 10.0.1.0/24 pointing back to the VPN tunnel, so return traffic from the server to the VM is dropped. Without this route, the on-premises router cannot forward packets destined for 10.0.1.10 back through the VPN.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The on-premises router does not have a route for the GCP subnet (10.0.1.0/24) pointing to the VPN tunnel.
Why this is correct
Without a return route, the on-premises server sends replies through the default route (likely internet), causing asymmetric routing and packet drop.
- ✗
The on-premises server is not configured with a default gateway pointing to the on-premises gateway.
Why it's wrong here
If the server had no default gateway, it wouldn't be able to reach the on-premises gateway either.
- ✗
The Cloud VPN tunnel is not configured with an IKE version supported by the on-premises device.
Why it's wrong here
The tunnel is established (VM can ping on-premises gateway), so IKE configuration is fine.
- ✗
A firewall rule on the GCP VPC is blocking ICMP traffic from 192.168.1.100.
Why it's wrong here
The firewall rule allows ingress from the entire on-premises subnet, so this is not the cause.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.