PCNE Implementing Hybrid Interconnectivity Practice Question
Your company has two on-premises data centers, DC1 and DC2, each connected to a separate Google Cloud VPC via Dedicated Interconnect. Both VPCs are connected via VPC Network Peering. A new application deployed in VPC1 needs to communicate with a database in DC2. The database IP range is 10.0.0.0/16. You have configured firewall rules to allow the traffic. However, the application cannot reach the database. You have verified that routes for 10.0.0.0/16 exist in VPC1's route table with next hop to VPC Peering, and in VPC2's route table with next hop to the interconnect attachment. The BGP sessions on both interconnects are up. What is the most likely reason for the connectivity failure?
⚠ Common exam trap
It's easy for candidates to assume VPC peering behaves like a router or a traditional network switch, supporting transitive routing, when in fact Google Cloud VPC peering is strictly non-transitive and requires a separate peering or a dedicated interconnect for each VPC-to-on-premises path.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Network Peering does not support transitive routing through a peered VPC
VPC Network Peering does not support transitive routing. In this topology, VPC1 is peered with VPC2, but traffic from VPC1 to DC2 must pass through VPC2 and then over the interconnect. Since VPC1's route for 10.0.0.0/16 points to the VPC peering as next hop, VPC1 expects the traffic to be forwarded directly to VPC2. However, VPC2 cannot forward that traffic to DC2 because Google Cloud VPC peering does not allow a peered VPC to act as a transit hub; each VPC can only communicate directly with its peer, not with resources reachable through that peer. This is a fundamental limitation of VPC Network Peering, which is non-transitive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The route for 10.0.0.0/16 in VPC1 is not imported correctly from VPC Peering
Why it's wrong here
The stem says routes exist, so this is not likely.
- ✓
VPC Network Peering does not support transitive routing through a peered VPC
Why this is correct
VPC Peering does not allow a peered VPC to forward traffic to another network, breaking the path from VPC1 to DC2.
- ✗
BGP session on the interconnect between VPC2 and DC2 is down
Why it's wrong here
Stem says BGP sessions are up.
- ✗
Firewall rules in VPC2 are blocking traffic
Why it's wrong here
Firewall rules are configured, but the issue is routing, not firewall.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.