How should I use these Implementing a Virtual Private Cloud practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

PCNE · topic practice

Implementing a Virtual Private Cloud practice questions

Q: Can I practise just Implementing a Virtual Private Cloud questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Implementing a Virtual Private Cloud domain.

Practise questions on cloud computing concepts covering service models, deployment types, and essential characteristics for the PCNE exam.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Implementing a Virtual Private Cloud

Practice 10 questions Browse domain →

What the exam tests

What to know about Implementing a Virtual Private Cloud

Tests understanding of cloud service models, deployment types, and characteristics like scalability and elasticity.

IaaS, PaaS, SaaS service model definitions and use cases

Public, private, hybrid cloud deployment distinctions

Key cloud characteristics: on-demand, broad network access

Metered usage and resource pooling concepts

Why learners struggle

Why Implementing a Virtual Private Cloud questions are commonly missed

Learners often confuse IaaS, PaaS, and SaaS because real-world examples blur boundaries. They also struggle distinguishing public vs private cloud deployment based on ownership and access.

·IaaS vs PaaS — infrastructure vs platform confusion
·Public vs private cloud — ownership and access
·Scalability vs elasticity — automatic vs manual
·On-demand vs reserved instances — cost models
·Resource pooling vs multi-tenancy — shared resources
·Metered usage vs subscription — billing differences

Watch out for

Common Implementing a Virtual Private Cloud exam traps

▸Confusing PaaS with SaaS because both involve software platforms
▸Thinking private cloud is always on-premises only
▸Assuming all cloud services are public by default
▸Mixing up elasticity with scalability in exam scenarios

Practice set

Implementing a Virtual Private Cloud questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Implementing a Virtual Private Cloud explanation →

A company is deploying a multi-tier web application on Google Cloud. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier must not have any public IP addresses. Which VPC design should be used?

Trap 1: Use a Shared VPC with separate subnets in different projects for…

Shared VPC is for multi-project environments, not for tier isolation within one organization.

Trap 2: Use a single VPC and connect the database tier via Cloud VPN to…

Cloud VPN does not address isolation between tiers within a VPC.

Trap 3: Use a single VPC with separate subnets for each tier and configure…

Single VPC does not provide network isolation at the VPC level; firewall rules alone can be misconfigured.

Study all Implementing a Virtual Private Cloud common traps →

A
Use a Shared VPC with separate subnets in different projects for each tier.
Why wrong: Shared VPC is for multi-project environments, not for tier isolation within one organization.
B
Use three separate VPCs for each tier and connect them using VPC peering.
Separate VPCs provide full isolation; peering allows controlled communication.
C
Use a single VPC and connect the database tier via Cloud VPN to on-premises.
Why wrong: Cloud VPN does not address isolation between tiers within a VPC.
D
Use a single VPC with separate subnets for each tier and configure firewall rules to restrict traffic.
Why wrong: Single VPC does not provide network isolation at the VPC level; firewall rules alone can be misconfigured.

Full breakdown with real-world context →

Question 2hardmultiple choice

Review the full subnetting walkthrough →

An organization has a VPC with custom mode subnets in us-central1 and europe-west1. They create a VM instance in us-central1 with an internal IP 10.0.1.2 and a VM in europe-west1 with internal IP 10.0.2.2. They want to enable communication between these instances using internal IPs. What must be configured?

Trap 1: Set up VPC peering between the two regions.

VPC peering is used between separate VPCs, not within the same VPC.

Trap 2: No additional configuration is needed because internal IPs are…

While internal IPs are routable, firewall rules must permit the traffic. Default rules allow it, but if custom rules are applied, they may block it.

Trap 3: Enable Cloud NAT for the VPC.

Cloud NAT is for internet access, not internal communication.

Study all Implementing a Virtual Private Cloud common traps →

A
Ensure the VPC firewall rules allow ingress from the source subnet or instance.
Firewall rules control traffic within a VPC; by default, all internal traffic is allowed, but custom rules could block it.
B
Set up VPC peering between the two regions.
Why wrong: VPC peering is used between separate VPCs, not within the same VPC.
C
No additional configuration is needed because internal IPs are routable within the VPC.
Why wrong: While internal IPs are routable, firewall rules must permit the traffic. Default rules allow it, but if custom rules are applied, they may block it.
D
Enable Cloud NAT for the VPC.
Why wrong: Cloud NAT is for internet access, not internal communication.

Full breakdown with real-world context →

Question 3easymultiple choice

Review the full subnetting walkthrough →

A startup wants to create a VPC with a subnet that can grow automatically as they add more VM instances. Which subnet type should they use?

Trap 1: Custom mode subnet

Custom mode gives full control but requires manual range expansion.

Trap 2: Dynamic subnet

No such subnet mode exists in Google Cloud.

Trap 3: Legacy network

Legacy networks are deprecated and not recommended.

Study all Implementing a Virtual Private Cloud common traps →

A
Custom mode subnet
Why wrong: Custom mode gives full control but requires manual range expansion.
B
Dynamic subnet
Why wrong: No such subnet mode exists in Google Cloud.
C
Legacy network
Why wrong: Legacy networks are deprecated and not recommended.
D
Auto mode subnet
Auto mode subnets automatically allocate IP ranges and expand as needed.

Full breakdown with real-world context →

Question 4mediummultiple choice

Review the full subnetting walkthrough →

A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They need to add a new subnet for a Kubernetes cluster that requires a secondary IP range for pods. The primary IP range of the new subnet must be 10.0.2.0/24. What is the correct way to create this subnet?

Trap 1: Create the subnet with primary range 10.0.2.0/24 and then update it…

Subnets cannot be updated after creation to add secondary ranges.

Trap 2: Create two subnets: one with 10.0.2.0/24 for primary and another…

Secondary ranges are part of the same subnet, not separate subnets.

Trap 3: Create an auto mode subnet and let Google Cloud assign the…

Auto mode does not automatically assign secondary ranges.

Study all Implementing a Virtual Private Cloud common traps →

A
Create the subnet with primary range 10.0.2.0/24 and specify the secondary range at creation time.
Secondary ranges must be specified at subnet creation.
B
Create the subnet with primary range 10.0.2.0/24 and then update it to add the secondary range.
Why wrong: Subnets cannot be updated after creation to add secondary ranges.
C
Create two subnets: one with 10.0.2.0/24 for primary and another for the secondary range.
Why wrong: Secondary ranges are part of the same subnet, not separate subnets.
D
Create an auto mode subnet and let Google Cloud assign the secondary range automatically.
Why wrong: Auto mode does not automatically assign secondary ranges.

Full breakdown with real-world context →

Question 5hardmultiple choice

Open the full BGP breakdown →

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

Trap 1: Cloud NAT

Cloud NAT provides internet access for private instances, not VPN routing.

Trap 2: VPC peering

VPC peering connects two VPCs, not on-premises to VPC.

Trap 3: VPC Flow Logs

Flow Logs record traffic metadata, not routing.

Study all Implementing a Virtual Private Cloud common traps →

A
Cloud NAT
Why wrong: Cloud NAT provides internet access for private instances, not VPN routing.
B
VPC peering
Why wrong: VPC peering connects two VPCs, not on-premises to VPC.
C
Cloud Router
Cloud Router manages BGP sessions for dynamic routing with VPN or Interconnect.
D
VPC Flow Logs
Why wrong: Flow Logs record traffic metadata, not routing.

Full breakdown with real-world context →

Question 6mediummulti select

Review the full subnetting walkthrough →

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

Trap 1: Configure Cloud NAT for the VPC.

Cloud NAT provides outbound internet, not inbound.

Trap 2: Enable Private Google Access on the subnet.

Private Google Access is for accessing Google APIs, not for general internet inbound.

Trap 3: Assign a static internal IP address to the VM.

Internal IP is not needed for inbound internet access.

Study all Implementing a Virtual Private Cloud common traps →

A
Configure Cloud NAT for the VPC.
Why wrong: Cloud NAT provides outbound internet, not inbound.
B
Assign an external IP address to the VM.
An external IP allows the VM to be reachable from the internet.
C
Enable Private Google Access on the subnet.
Why wrong: Private Google Access is for accessing Google APIs, not for general internet inbound.
D
Assign a static internal IP address to the VM.
Why wrong: Internal IP is not needed for inbound internet access.
E
Create a firewall rule to allow ingress on TCP port 80 from 0.0.0.0/0.
Firewall rule must permit incoming HTTP traffic.

Full breakdown with real-world context →

Question 7hardmulti select

Read the full Implementing a Virtual Private Cloud explanation →

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

Trap 1: Cloud VPN

Cloud VPN is for connecting on-premises, not for multi-project VPC.

Trap 2: VPC peering

VPC peering is not needed when using Shared VPC.

Study all Implementing a Virtual Private Cloud common traps →

A
Service projects
Service projects consume Shared VPC networks.
B
Host project
The host project contains the Shared VPC network.
C
Cloud VPN
Why wrong: Cloud VPN is for connecting on-premises, not for multi-project VPC.
D
VPC peering
Why wrong: VPC peering is not needed when using Shared VPC.
E
Shared VPC
Shared VPC enables centralized network management across projects.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full VPN explanation →

A company is migrating its on-premises infrastructure to Google Cloud. They need to connect their VPC to a third-party SaaS provider that only supports IPsec VPN. The company requires high availability and automatic failover. Which solution should they implement?

Trap 1: Use Dedicated Interconnect with VLAN attachments to the SaaS…

Dedicated Interconnect is a direct physical connection, not IPsec VPN, and may not be supported by the SaaS provider.

Trap 2: Deploy a Classic VPN tunnel with policy-based routing.

Classic VPN does not support BGP dynamic routing, so failover is not automatic.

Trap 3: Deploy a single Cloud VPN tunnel and use static routing.

Static routing does not support automatic failover; single tunnel is a single point of failure.

Study all Implementing a Virtual Private Cloud common traps →

A
Deploy two Cloud VPN tunnels from two Cloud Routers with BGP sessions to the peer VPN device.
This provides HA with automatic failover via BGP; Cloud Routers enable dynamic routing and fast convergence.
B
Use Dedicated Interconnect with VLAN attachments to the SaaS provider.
Why wrong: Dedicated Interconnect is a direct physical connection, not IPsec VPN, and may not be supported by the SaaS provider.
C
Deploy a Classic VPN tunnel with policy-based routing.
Why wrong: Classic VPN does not support BGP dynamic routing, so failover is not automatic.
D
Deploy a single Cloud VPN tunnel and use static routing.
Why wrong: Static routing does not support automatic failover; single tunnel is a single point of failure.

Full breakdown with real-world context →

Question 9hardmultiple choice

Read the full Implementing a Virtual Private Cloud explanation →

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

Trap 1: Use Cloud DNS with geo-routing to direct users to regional load…

DNS-based routing does not provide the performance of proximity-based anycast on Google's network; it also has caching issues.

Trap 2: Set up Cloud NAT with multiple static IP addresses for each region.

Cloud NAT is for outbound traffic only, not for inbound user traffic.

Trap 3: Assign a global anycast IP address to all instances and use BGP to…

Global anycast IP addresses are not supported in Google Cloud for direct instance assignment; BGP advertising is not possible.

Study all Implementing a Virtual Private Cloud common traps →

A
Deploy a global HTTP(S) Load Balancer with backend services in each region.
Global HTTP(S) LB uses anycast IP and proxies traffic to the closest region, reducing latency.
B
Use Cloud DNS with geo-routing to direct users to regional load balancers.
Why wrong: DNS-based routing does not provide the performance of proximity-based anycast on Google's network; it also has caching issues.
C
Set up Cloud NAT with multiple static IP addresses for each region.
Why wrong: Cloud NAT is for outbound traffic only, not for inbound user traffic.
D
Assign a global anycast IP address to all instances and use BGP to advertise it.
Why wrong: Global anycast IP addresses are not supported in Google Cloud for direct instance assignment; BGP advertising is not possible.

Full breakdown with real-world context →

Question 10easymultiple choice

Read the full VPN explanation →

A developer created a Compute Engine instance in the default VPC network. The instance needs to communicate with an on-premises server over a Cloud VPN tunnel. The developer configured the VPN tunnel but the instances cannot ping the on-premises server. What is the most likely cause?

Trap 1: The subnet IP range overlaps with the on-premises network.

Default VPC uses Auto mode subnets with non-overlapping ranges; overlap is unlikely but would cause routing issues, not firewall.

Trap 2: The instance has IP forwarding disabled.

IP forwarding is required only for instances acting as routers, not for general communication.

Trap 3: The default VPC does not have a default route to the internet.

Default VPC has a default route (0.0.0.0/0) to the internet via the default internet gateway.

Study all Implementing a Virtual Private Cloud common traps →

A
The subnet IP range overlaps with the on-premises network.
Why wrong: Default VPC uses Auto mode subnets with non-overlapping ranges; overlap is unlikely but would cause routing issues, not firewall.
B
The instance has IP forwarding disabled.
Why wrong: IP forwarding is required only for instances acting as routers, not for general communication.
C
The default VPC does not have a default route to the internet.
Why wrong: Default VPC has a default route (0.0.0.0/0) to the internet via the default internet gateway.
D
The firewall rules in the VPC are blocking ingress traffic from the on-premises network.
Default firewall rules allow only certain ingress; ICMP from on-premises is not allowed by default.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Implementing a Virtual Private Cloud explanation →

A company is designing a network for a critical application that requires sub-millisecond latency between two Compute Engine instances. The instances are located in different zones within the same region. Which VPC configuration will provide the lowest latency?

Trap 1: Use VPC Network Peering between two different VPCs.

Peering adds a slight overhead; same VPC is better.

Trap 2: Place instances in different VPCs and use a VPN between them.

VPN adds encryption overhead and extra latency.

Trap 3: Assign external IP addresses to both instances and communicate over…

External IPs traverse the internet gateway, increasing latency.

Study all Implementing a Virtual Private Cloud common traps →

A
Use VPC Network Peering between two different VPCs.
Why wrong: Peering adds a slight overhead; same VPC is better.
B
Place instances in different VPCs and use a VPN between them.
Why wrong: VPN adds encryption overhead and extra latency.
C
Place both instances in the same VPC, using internal IP addresses.
Internal IPs stay within Google's network, providing lowest latency.
D
Assign external IP addresses to both instances and communicate over the internet.
Why wrong: External IPs traverse the internet gateway, increasing latency.

Full breakdown with real-world context →

Question 12mediummulti select

Read the full VPN explanation →

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

Trap 1: Cloud DNS forwarding zone to forward requests to Google APIs'…

Private Google Access does not require DNS changes; it works with standard DNS resolution.

Trap 2: Firewall rule allowing ingress from on-premises to 0.0.0.0/0.

Firewall rules need to allow only the specific Google API IP ranges, not all destinations.

Trap 3: Cloud NAT configured in the VPC.

Cloud NAT is not required for private Google Access; it is for internet access.

Study all Implementing a Virtual Private Cloud common traps →

A
Cloud DNS forwarding zone to forward requests to Google APIs' public DNS.
Why wrong: Private Google Access does not require DNS changes; it works with standard DNS resolution.
B
Private Google Access enabled on the subnet where the VPN gateway resides.
This allows on-premises traffic to reach Google APIs via the VPN.
C
Firewall rule allowing ingress from on-premises to 0.0.0.0/0.
Why wrong: Firewall rules need to allow only the specific Google API IP ranges, not all destinations.
D
Cloud NAT configured in the VPC.
Why wrong: Cloud NAT is not required for private Google Access; it is for internet access.
E
A custom route in the VPC that sends traffic to 199.36.153.4/30 and 199.36.153.8/30 to the VPN tunnel.
These are the IP ranges used for private Google Access; routes must be in place.

Full breakdown with real-world context →

Question 13hardmulti select

Review the full subnetting walkthrough →

A company has a VPC with multiple subnets. They want to restrict traffic between two subnets (Subnet-A and Subnet-B) using VPC firewall rules. Which THREE conditions must be met for a firewall rule to block traffic from Subnet-A to Subnet-B?

Trap 1: The rule must be applied using network tags on instances in…

Tags are optional; the rule can also apply to all instances in the subnet via target tags or service accounts.

Trap 2: The rule must also allow return traffic from Subnet-B to Subnet-A.

Firewall rules are stateless; return traffic is not automatically allowed; separate rules are needed.

Study all Implementing a Virtual Private Cloud common traps →

A
The rule must be applied using network tags on instances in Subnet-A.
Why wrong: Tags are optional; the rule can also apply to all instances in the subnet via target tags or service accounts.
B
The rule must be an ingress rule with source set to Subnet-A IP range and destination set to Subnet-B IP range.
To block traffic from A to B, the ingress rule on Subnet-B must block source A.
C
The rule must have action set to 'deny' and apply to all instances in Subnet-B.
The rule must deny traffic and target the destination subnet instances.
D
The rule must also allow return traffic from Subnet-B to Subnet-A.
Why wrong: Firewall rules are stateless; return traffic is not automatically allowed; separate rules are needed.
E
The rule must have a lower priority number (higher priority) than any allow rules between the subnets.
Priority numbers: lower number = higher priority. Deny rules must outrank allow rules.

Full breakdown with real-world context →

Question 14hardmultiple choice

Open the full BGP breakdown →

A financial services company is deploying a multi-tier application in a custom VPC with three subnets: web (10.0.1.0/24), app (10.0.2.0/24), and db (10.0.3.0/24). They use a Cloud VPN with dynamic routing (BGP) to connect to their on-premises data center (10.1.0.0/16). The on-premises network administrator reports that traffic from the web tier (10.0.1.0/24) to on-premises is working, but traffic from the app tier (10.0.2.0/24) to on-premises is failing. The company uses an Identity-Aware Proxy (IAP) for SSH access. The following configurations are in place: - Cloud Router advertises all VPC subnets via BGP. - On-premises router advertises 10.1.0.0/16. - Firewall rules allow all traffic from 10.0.0.0/16 to 10.1.0.0/16. - The app tier instances have a network tag 'app-tier' and a service account 'app-sa@project.iam.gserviceaccount.com'. - There is a firewall rule with priority 1000 that denies egress from tags 'app-tier' to 10.1.0.0/16. What is the most likely cause of the failure?

Trap 1: The service account 'app-sa' does not have permissions to send…

Service accounts do not control network traffic; firewall rules do.

Trap 2: IAP is blocking traffic from the app tier because it is not…

IAP is used for SSH access, not for general traffic to on-premises.

Trap 3: The Cloud Router is not advertising the 10.0.2.0/24 subnet to…

The Cloud Router is configured to advertise all subnets, so 10.0.2.0/24 should be advertised.

Study all Implementing a Virtual Private Cloud common traps →

A
The service account 'app-sa' does not have permissions to send traffic through the VPN.
Why wrong: Service accounts do not control network traffic; firewall rules do.
B
IAP is blocking traffic from the app tier because it is not configured for that subnet.
Why wrong: IAP is used for SSH access, not for general traffic to on-premises.
C
A firewall egress rule with priority 1000 denies traffic from instances with tag 'app-tier' to 10.1.0.0/16.
This deny rule explicitly blocks the traffic, overriding any lower-priority allow rules.
D
The Cloud Router is not advertising the 10.0.2.0/24 subnet to on-premises.
Why wrong: The Cloud Router is configured to advertise all subnets, so 10.0.2.0/24 should be advertised.

Full breakdown with real-world context →

Question 15hardmultiple choice

Review the full subnetting walkthrough →

Your company runs a multi-tier web application on Google Cloud. The application consists of frontend instances in a managed instance group (MIG) in us-central1, backend instances in a MIG in us-west1, and a Cloud SQL database in us-central1. The frontend and backend communicate over a VPC network with custom subnet mode (10.0.0.0/16) and use internal IP addresses. Recently, the application experienced intermittent timeouts. You notice that the backend instances in us-west1 have high latency when querying the Cloud SQL database in us-central1. You suspect network congestion or suboptimal routing. You want to minimize latency between the regions for database queries while ensuring the most cost-effective solution. What should you do?

Trap 1: Move all resources to a single region, such as us-central1, and use…

This defeats the purpose of multi-region deployment and may increase latency for users in other regions.

Trap 2: Create a VPC peering connection between the frontend and backend…

VPC peering is used to connect separate VPC networks, not to improve routing within the same VPC.

Trap 3: Enable Cloud CDN on the backend load balancer to cache database…

Database queries are dynamic and not suitable for caching; Cloud CDN is for static content.

Study all Implementing a Virtual Private Cloud common traps →

A
Move all resources to a single region, such as us-central1, and use a single VPC.
Why wrong: This defeats the purpose of multi-region deployment and may increase latency for users in other regions.
B
Set up a Cloud VPN tunnel with Cloud Router and use BGP to advertise routes between the two regions.
This provides a dedicated encrypted tunnel and dynamic routing, which can reduce latency by using a more direct path than the public internet.
C
Create a VPC peering connection between the frontend and backend VPCs.
Why wrong: VPC peering is used to connect separate VPC networks, not to improve routing within the same VPC.
D
Enable Cloud CDN on the backend load balancer to cache database responses.
Why wrong: Database queries are dynamic and not suitable for caching; Cloud CDN is for static content.

Full breakdown with real-world context →

Question 16mediummulti select

Review the full subnetting walkthrough →

A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)

Trap 1: Create firewall rules allowing all traffic from the other region's…

Firewall rules only permit traffic; they don't establish connectivity between separate VPCs.

Trap 2: Configure instances to use external IP addresses for cross-region…

External IP traffic traverses the internet, not internal IPs.

Trap 3: Use a shared VPC to connect both regions.

Shared VPC allows multiple projects to use the same VPC but does not connect separate VPCs across regions.

Study all Implementing a Virtual Private Cloud common traps →

A
Set up VPC peering between the VPCs in each region.
VPC peering allows using internal IP addresses across regions.
B
Set up Cloud VPN or Dedicated Interconnect between the two VPCs.
Cloud VPN or Interconnect enables private IP communication across regions.
C
Create firewall rules allowing all traffic from the other region's subnet CIDR.
Why wrong: Firewall rules only permit traffic; they don't establish connectivity between separate VPCs.
D
Configure instances to use external IP addresses for cross-region communication.
Why wrong: External IP traffic traverses the internet, not internal IPs.
E
Use a shared VPC to connect both regions.
Why wrong: Shared VPC allows multiple projects to use the same VPC but does not connect separate VPCs across regions.

Full breakdown with real-world context →

Question 17easymultiple choice

Review the full subnetting walkthrough →

Your company has a VPC with a single subnet in us-central1 (10.0.1.0/24). You have a managed instance group (MIG) of web servers (10.0.1.2-10.0.1.10) and a standalone database instance (10.0.1.100). The web servers need to communicate with the database on TCP port 3306. You have configured a firewall rule allowing ingress from 10.0.1.0/24 to 10.0.1.100 on tcp:3306. However, the web servers cannot connect to the database. You verified that the database is running and listening on port 3306, and that the web servers can ping the database. What should you do to resolve the issue?

Trap 1: Create a custom route from the web servers to the database.

The web servers can ping the database, so routing is working; a custom route is unnecessary.

Trap 2: Add a network tag 'db' to the database instance and update the…

The existing firewall rule already targets the database IP, so a tag is not needed; the instance might still have OS firewall blocking.

Trap 3: Configure the firewall rule to use the database's service account…

Service account targeting is for VMs, but the database's OS firewall is the likely culprit.

Study all Implementing a Virtual Private Cloud common traps →

A
Create a custom route from the web servers to the database.
Why wrong: The web servers can ping the database, so routing is working; a custom route is unnecessary.
B
Check the database instance's OS-level firewall (e.g., iptables) and ensure it allows traffic on port 3306 from the web servers.
The VPC firewall allows traffic, but the OS firewall on the database may be blocking the connection.
C
Add a network tag 'db' to the database instance and update the firewall rule to target 'db'.
Why wrong: The existing firewall rule already targets the database IP, so a tag is not needed; the instance might still have OS firewall blocking.
D
Configure the firewall rule to use the database's service account as the target.
Why wrong: Service account targeting is for VMs, but the database's OS firewall is the likely culprit.

Full breakdown with real-world context →

Question 18mediumdrag order

Read the full NAT/PAT explanation →

Drag and drop the steps to configure a Cloud NAT for private instances to access the internet into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 19mediummatching

Open the full BGP breakdown →

Match each Cloud Router BGP attribute to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Unique autonomous system number for the router

MED value to influence inbound traffic

IP address of the BGP peer

ASN of the BGP peer

Time between BGP keepalive messages

Question 20mediummultiple choice

Review the full subnetting walkthrough →

An engineer has set up VPC Network Peering between VPC-A and VPC-B. Both VPCs have non-overlapping CIDR ranges. The peering state is ACTIVE. However, instances in VPC-A cannot reach instances in VPC-B. The engineer verified that firewall rules allow the traffic. What should the engineer check next?

Trap 1: The BGP session status on the Cloud Router.

VPC peering does not use BGP.

Trap 2: The MTU size of the instances.

MTU mismatch might cause packet drops but not complete failure.

Trap 3: The route tables for the peered network.

The route tables are not misconfigured; the issue is export of subnet routes.

Study all Implementing a Virtual Private Cloud common traps →

A
The subnet routes are exported from VPC-B to VPC-A.
Subnet routes must be exported explicitly if default export settings are changed.
B
The BGP session status on the Cloud Router.
Why wrong: VPC peering does not use BGP.
C
The MTU size of the instances.
Why wrong: MTU mismatch might cause packet drops but not complete failure.
D
The route tables for the peered network.
Why wrong: The route tables are not misconfigured; the issue is export of subnet routes.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Implementing a Virtual Private Cloud sessions

Start a Implementing a Virtual Private Cloud only practice session

Every question in these sessions is drawn from the Implementing a Virtual Private Cloud domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Implementing a Virtual Private Cloud questions →Mixed PCNE session

Frequently asked questions

What does the PCNE exam test about Implementing a Virtual Private Cloud?: Tests understanding of cloud service models, deployment types, and characteristics like scalability and elasticity.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Implementing a Virtual Private Cloud questions in a focused session?: Yes — the session launcher on this page draws every question from the Implementing a Virtual Private Cloud domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCNE topics?: Use the topic links above to move to related areas, or go back to the PCNE question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCNE exam covers. They are not copied from any real exam or dump site.

Implementing a Virtual Private Cloud only

10 questions 20 questions 30 questions 50 questions

Mixed PCNE session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCNE questions Implementing a Virtual Private Cloud domain overview PCNE exam guide

Exam traps to avoid

▸Confusing PaaS with SaaS because both involve software platforms
▸Thinking private cloud is always on-premises only
▸Assuming all cloud services are public by default
▸Mixing up elasticity with scalability in exam scenarios

Implementing a Virtual Private Cloud practice questions

What to know about Implementing a Virtual Private Cloud

Why Implementing a Virtual Private Cloud questions are commonly missed

Common Implementing a Virtual Private Cloud exam traps

Implementing a Virtual Private Cloud questions

A company is deploying a multi-tier web application on Google Cloud. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. The database tier must not have any public IP addresses. Which VPC design should be used?

A startup wants to create a VPC with a subnet that can grow automatically as they add more VM instances. Which subnet type should they use?

A company has a VPC with a subnet 10.0.1.0/24 in us-central1. They need to add a new subnet for a Kubernetes cluster that requires a secondary IP range for pods. The primary IP range of the new subnet must be 10.0.2.0/24. What is the correct way to create this subnet?

An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They plan to use Cloud VPN with dynamic routing (BGP). Which VPC feature is required for this setup?

A company has a VPC with a subnet in us-central1 and needs to allow HTTP traffic (port 80) from the internet to a VM instance. Which TWO configurations are required?

A company is designing a VPC for a production environment that must meet the following requirements: support multiple projects, centralized network administration, and allow each project to have its own firewall rules. Which THREE components should be used?

A company is migrating its on-premises infrastructure to Google Cloud. They need to connect their VPC to a third-party SaaS provider that only supports IPsec VPN. The company requires high availability and automatic failover. Which solution should they implement?

A company has deployed a global application on Compute Engine instances in multiple regions. Users are experiencing high latency connecting to the application. The network team wants to use Google Cloud's global network to improve performance. Which approach should they take?

A developer created a Compute Engine instance in the default VPC network. The instance needs to communicate with an on-premises server over a Cloud VPN tunnel. The developer configured the VPN tunnel but the instances cannot ping the on-premises server. What is the most likely cause?

A company is designing a network for a critical application that requires sub-millisecond latency between two Compute Engine instances. The instances are located in different zones within the same region. Which VPC configuration will provide the lowest latency?

A company is setting up a VPC with private Google Access enabled for on-premises connectivity via Cloud VPN. Which TWO of the following are required for on-premises hosts to access Google APIs (e.g., Cloud Storage) using private IP addresses?

A company has a VPC with multiple subnets. They want to restrict traffic between two subnets (Subnet-A and Subnet-B) using VPC firewall rules. Which THREE conditions must be met for a firewall rule to block traffic from Subnet-A to Subnet-B?

A company is designing a VPC with multiple subnets across two regions for high availability. They want to ensure that instances in different regions can communicate using internal IP addresses without traversing the public internet. Which TWO actions should they take? (Choose two.)

Drag and drop the steps to configure a Cloud NAT for private instances to access the internet into the correct order.

Match each Cloud Router BGP attribute to its function.

An engineer has set up VPC Network Peering between VPC-A and VPC-B. Both VPCs have non-overlapping CIDR ranges. The peering state is ACTIVE. However, instances in VPC-A cannot reach instances in VPC-B. The engineer verified that firewall rules allow the traffic. What should the engineer check next?

Track your progress over time

Start a Implementing a Virtual Private Cloud only practice session

Related PCNE topic practice pages

Designing, planning, and prototyping a GCP network practice questions

Implementing hybrid interconnectivity practice questions

Configuring network services practice questions

Implementing network security practice questions