The answer is a missing custom static route in the VPC for destination 192.168.0.0/16 with next hop set to the Cloud VPN gateway. Without this specific route, traffic from a GCE instance to an on-premises IP like 192.168.1.10 matches the broader 0.0.0.0/0 default route, which points to the internet gateway, so the packets are sent out to the internet instead of through the VPN tunnel, causing a timeout. On the Google Professional Cloud Network Engineer exam, this scenario tests your understanding of route priority and the fact that a default route does not automatically direct VPN traffic; you must explicitly create a static route for the on-premises network. A common trap is assuming the VPN tunnel alone handles all traffic, but GCP requires a matching route entry. Remember the mnemonic: "VPN needs its own lane"—without a specific route, your traffic takes the default highway to the internet.
PCNE Practice Question: Designing, planning, and prototyping a GCP network
This PCNE practice question tests your understanding of designing, planning, and prototyping a gcp network. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has a VPC with a subnet in us-central1 (10.0.0.0/16) and a Cloud VPN tunnel to an on-premises network (192.168.0.0/16). They also have a static route for 0.0.0.0/0 internet gateway. On-premises traffic to 10.0.0.0/16 is working. However, traffic from a GCE instance in the VPC to an on-premises IP 192.168.1.10 is timing out. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Missing a custom static route in the VPC for destination 192.168.0.0/16 with next hop VPN gateway
Option B is correct because the VPC has a default route (0.0.0.0/0) pointing to the internet gateway, but no specific route for the on-premises network (192.168.0.0/16). Without a custom static route with next hop set to the VPN gateway, traffic from the GCE instance to 192.168.1.10 will be forwarded to the internet gateway instead of the VPN tunnel, causing a timeout.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Cloud NAT is not configured for the VPC
Why it's wrong here
Cloud NAT is for outbound internet access, not for VPN traffic.
✓
Missing a custom static route in the VPC for destination 192.168.0.0/16 with next hop VPN gateway
Why this is correct
Without this route, traffic is sent to the internet instead of the VPN.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The VPN tunnel is down and BGP session is not established
Why it's wrong here
On-premises traffic to GCP is working, so the VPN is up.
✗
Firewall rule does not allow inbound traffic from on-premises to the instance
Why it's wrong here
Inbound firewall rules are not needed for traffic originating from the instance going out.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume a working VPN tunnel automatically routes traffic in both directions, but GCP requires explicit static routes for each destination network behind the VPN, even when the tunnel itself is up.
Detailed technical explanation
How to think about this question
In GCP, VPC routes are evaluated based on the most specific prefix match. A default route (0.0.0.0/0) to the internet gateway will match any destination not covered by a more specific route. Since 192.168.0.0/16 is not explicitly routed to the VPN gateway, packets destined for 192.168.1.10 follow the default route and are dropped at the internet gateway. This is a common misconfiguration when using static routing with Cloud VPN, as opposed to dynamic routing with Cloud Router, which would automatically propagate the on-premises prefix.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Designing, planning, and prototyping a GCP network — This question tests Designing, planning, and prototyping a GCP network — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Missing a custom static route in the VPC for destination 192.168.0.0/16 with next hop VPN gateway — Option B is correct because the VPC has a default route (0.0.0.0/0) pointing to the internet gateway, but no specific route for the on-premises network (192.168.0.0/16). Without a custom static route with next hop set to the VPN gateway, traffic from the GCE instance to 192.168.1.10 will be forwarded to the internet gateway instead of the VPN tunnel, causing a timeout.
What should I do if I get this PCNE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.