GoogleGoogle Professional Cloud Network Engineer (PCNE) Certification·EN·Updated 22 Aug 2026
Hub VPC uses HA VPN and Cloud Router (default). On‑prem DNS at 192.168.20.88. Ensure Compute Engine in multiple spoke VPCs resolve on‑prem private names for corp.altostrat.com and still resolve Google Cloud names; follow Google best practices. What should you do?
Choose an answer
Tap an option to check your answer.
Correct answer: Create a private forwarding zone in Cloud DNS for corp.altostrat.com that forwards to 192.168.20.88; associate the zone with the hub VPC. Create a private peering zone for corp.altostrat.com associated with the spoke VPCs with the hub VPC as the target. Set a custom route advertisement on the Cloud Router for 35.199.192.0/19. Configure VPC peering between each spoke VPC and the hub VPC..
Why this is the answer
The correct solution uses a private forwarding zone in the hub VPC to direct corp.altostrat.com queries to the on-prem DNS server. A private peering zone in each spoke VPC, targeting the hub VPC, allows spokes to resolve these names via the hub. VPC peering between spokes and the hub is essential for this communication. Advertising the 35.199.192.0/19 (Cloud DNS forwarding IP range) route on the Cloud Router ensures the on-prem DNS server can send responses back to Cloud DNS. This design follows Google's best practices for hybrid DNS resolution in a hub-and-spoke topology. Other options are incorrect because they either miss crucial components like VPC peering or peering zones, or propose unnecessary VPNs in each spoke.