The answer is that the private zone in Network A is not configured to allow resolution from peered networks. This is the most likely reason for the resolution failure because Cloud DNS private zones operate with an explicit opt-in for cross-network visibility; even with VPC peering and a DNS peering zone established in Network B, the source zone in Network A must have its "Allow resolution from peered networks" setting enabled to accept queries from the peered VPC. On the Google Professional Cloud Network Engineer exam, this scenario tests your understanding that DNS peering zones are directional and that the private zone’s visibility is a separate permission from the peering connection itself—a common trap is assuming that active peering alone grants DNS resolution. Remember the mnemonic "Peering is for traffic, permission is for queries": VPC peering handles network traffic, but DNS resolution across peered VPCs requires explicitly enabling that permission on the private zone.
PCNE Configuring network services Practice Question
This PCNE practice question tests your understanding of configuring network services. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has two VPC networks in the same project: Network A (hosting a private zone for 'example.internal.') and Network B. They are connected via VPC peering. The network engineer created a DNS peering zone in Network B for 'example.internal.' pointing to Network A. However, instances in Network B cannot resolve 'host.example.internal.' which is defined in Network A's private zone. The engineer verified that the peering zone is active and the networks are properly peered. What is the most likely reason for the resolution failure?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The private zone in Network A is not configured to allow resolution from peered networks.
Option D is correct because Cloud DNS private zones do not automatically allow resolution from peered VPC networks unless explicitly configured. Even though VPC peering and DNS peering are active, the private zone in Network A must have its 'Allow resolution from peered networks' setting enabled. Without this, queries from Network B via the DNS peering zone are rejected, causing resolution failures for records like 'host.example.internal.'.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
An inbound server policy must be created in Network A.
Why it's wrong here
Inbound server policies are for on-premises DNS resolvers to query Cloud DNS.
✗
The peering zone should be a forwarding zone instead.
Why it's wrong here
A peering zone is the correct choice; a forwarding zone requires an IP address of a DNS server, which is not the case here.
✗
An outbound server policy must be created in Network B.
Why it's wrong here
Outbound server policies allow VPC instances to forward queries to on-premises DNS, not the other way.
✓
The private zone in Network A is not configured to allow resolution from peered networks.
Why this is correct
Private zones must explicitly list which VPC networks can query them via peering.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the distinction between VPC peering connectivity and DNS resolution permissions, trapping candidates who assume that active VPC peering and a DNS peering zone are sufficient without checking the private zone's peering settings.
Detailed technical explanation
How to think about this question
In Google Cloud DNS, private zones are scoped to the VPC network they are attached to. When a DNS peering zone is created in Network B pointing to Network A, it tells Network B's DNS to forward queries for 'example.internal.' to Network A's DNS. However, Network A's private zone will only respond to those queries if the 'Peering' setting (under 'DNS resolution from peered networks') is enabled. This is a common misconfiguration because VPC peering itself does not automatically grant DNS resolution permissions; it only provides network connectivity. The DNS peering zone is the mechanism for query routing, but the target zone must explicitly authorize the peering source.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Configuring network services — This question tests Configuring network services — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The private zone in Network A is not configured to allow resolution from peered networks. — Option D is correct because Cloud DNS private zones do not automatically allow resolution from peered VPC networks unless explicitly configured. Even though VPC peering and DNS peering are active, the private zone in Network A must have its 'Allow resolution from peered networks' setting enabled. Without this, queries from Network B via the DNS peering zone are rejected, causing resolution failures for records like 'host.example.internal.'.
What should I do if I get this PCNE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. A DNS managed zone is configured with private visibility and associated with a VPC network. A Compute Engine instance in a different VPC network tries to resolve 'test.example.com' but fails. What is the most likely reason?
medium
A.The zone is not set as authoritative for example.com.
B.The Cloud DNS name servers are not reachable from the instance.
✓ C.The instance's VPC is not in the list of authorized networks.
D.The instance does not have the required IAM permissions.
Why C: Private zones only respond to queries from authorized VPC networks. The instance is in a different VPC, so resolution fails.
Last reviewed: Jun 30, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.