How to Configure DNS Forwarding Across Isolated VPC Networks?

PCNE By islever Editorial Last updated

Short answer

D Configure a Cloud DNS Peering zone in Department A's VPC network pointing to Department B's VPC and a Cloud DNS outbound forwarding zone in Department B's VPC network. Use separate on-premises links in each VPC network.

Question

Your company recently migrated to Google Cloud. You configured separate Virtual Private Cloud (VPC) networks for Department A and Department B. You need to configure both VPC networks to have access to the same on-premises location through separate links with full isolation between the VPC networks. Your design must also query on-premises DNS servers from workloads in Google Cloud using conditional forwarding. You want to minimize operational overhead. What should you do?
  1. Customize the operating system DNS configuration files to target the on-premises DNS servers.
  2. Keep the different VPC networks from both departments isolated with different on-premises links, and separate Cloud DNS private zones and Cloud DNS forwarding zones.
  3. Peer Department A's and Department B's VPC networks to have all on-premises connectivity via a single VPC network. Use separate Cloud DNS private zones and Cloud DNS forwarding zones.
  4. Configure a Cloud DNS Peering zone in Department A's VPC network pointing to Department B's VPC and a Cloud DNS outbound forwarding zone in Department B's VPC network. Use separate on-premises links in each VPC network. Correct Answer

Key Takeaways

The question evaluates knowledge of Google’s Cloud DNS best practices, specifically why configuring outbound forwarding in multiple VPCs fails due to shared source IP ranges and how DNS peering resolves this.

This scenario tests optimal Cloud DNS configuration across multiple isolated VPCs while querying on-premises servers. Community consensus strongly favors DNS peering over redundant outbound forwarding zones to prevent asymmetric routing issues.

Common mistake: Many candidates select Option B, assuming complete separation is always required. However, maintaining independent forwarding zones in multiple VPCs triggers return traffic routing failures because all queries originate from the same 35.199.192.0/19 IP block.

Expert Analysis

Why the Answer Is Correct

Option D correctly implements a centralized DNS forwarding model by using a Cloud DNS peering zone in one VPC to resolve queries for the other, while only one VPC maintains the actual outbound forwarding zone to on-premises DNS servers. This design adheres to Google Cloud best practices by eliminating the risk of asymmetric routing and response mismatches that occur when multiple VPCs attempt direct outbound forwarding. It also preserves the required full isolation between Department A and Department B VPCs while minimizing management overhead.

Why the Other Options Are Wrong

Option A introduces high operational overhead and breaks cloud-native automation principles by requiring manual OS-level modifications. Option B violates established Google Cloud networking guidelines, as separate outbound forwarding zones in multiple VPCs will fail due to identical source IP ranges causing ambiguous DNS response routing. Option C directly contradicts the requirement for full VPC isolation by forcing inter-VPC peering solely for on-premises connectivity, which increases complexity and blast radius.

Community Comment Notes

Multiple highly-voted comments highlight Google’s official recommendation to avoid outbound forwarding from multiple VPC networks due to shared source IP constraints [1][3][5]. Commenters note that DNS peering effectively centralizes resolution without compromising VPC isolation, directly addressing the exam’s focus on minimizing overhead [1][5]. Several users initially debated Option B but corrected themselves after reviewing the official best practices documentation on Cloud DNS architecture [2][8].

Official Reference

https://cloud.google.com/dns/docs/best-practices#use-dns-peering-to-avoid-outbound-forwarding-from-multiple_vpc-networks

This link opens the official vendor documentation in a new tab.

Exam Strategy

When encountering multi-VPC DNS scenarios, immediately look for options that centralize forwarding via DNS peering rather than duplicating outbound zones. Prioritize answers that align with Google’s architectural guardrails for return traffic routing and explicitly mention minimizing operational overhead through native service integration.

Community Votes

D
57%
B
43%

57% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 12 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 12

  1. gonlafer 👍 7 Answered D
    B is not an option as per Google best practices: https://cloud.google.com/dns/docs/best-practices#use-dns-peering-to-avoid-outbound-forwarding-from-multiple_vpc-networks therefore I see D as best option
  2. [Removed] 👍 5 Answered B
    The scenario outlines the need for separate VPC networks for Department A and Department B with access to the same on-premises location through separate links while maintaining full isolation between the VPC networks. Additionally, the design should allow querying on-premises DNS servers from Google Cloud workloads using conditional forwarding while minimizing operational overhead. Given these requirements, the most suitable option is: B. Keep the different VPC networks from both departments isolated with different on-premises links, and separate Cloud DNS private zones and Cloud DNS forwarding zones.
  3. PeppaPig 👍 4
    D is the answer B is clearly wrong. You should avoid outbound DNS forwarding from multiple VPCs https://cloud.google.com/dns/docs/best-practices#use-dns-peering-to-avoid-outbound-forwarding-from-multiple_vpc-networks
  4. hamish88 👍 2 Answered D
    Do not use outbound forwarding to your on-premises DNS servers from multiple VPC networks because it creates problems with the return traffic. Google Cloud accepts responses from your DNS servers only if they're routed to the VPC network from which the query originated. However, queries from any VPC network have the same IP range 35.199.192.0/19 as source. Therefore, responses can't be routed correctly unless you have separate environments on-premises.
  5. irmingard_examtopics 👍 2 Answered D
    Use DNS peering to avoid outbound forwarding from multiple VPC networks https://cloud.google.com/dns/docs/best-practices#use-dns-peering-to-avoid-outbound-forwarding-from-multiple_vpc-networks
Show 7 more comments
  1. saraali 👍 1 Answered B
    Why not D D. Configure a Cloud DNS Peering zone in Department A's VPC network pointing to Department B's VPC and a Cloud DNS outbound forwarding zone in Department B's VPC network. Use separate on-premises links in each VPC network: While this could work for DNS, it introduces unnecessary complexity by using Cloud DNS Peering, which is not required for the desired outcome. Also, DNS peering doesn't fully meet the isolation requirement between the VPCs. Conclusion: B is the best option because it maintains the required isolation between the two VPCs, while also addressing the need to forward DNS queries to on-premises servers using conditional forwarding.
  2. saraali 👍 1 Answered B
    B is the best option because it maintains the required isolation between the two VPCs, while also addressing the need to forward DNS queries to on-premises servers using conditional forwarding.
  3. jfwahab 👍 1 Answered C
    Peer each of Department A's and Department B's VPC networks to a single VPC network that connects to on-premises. Use separate Cloud DNS private zones and Cloud DNS forwarding zones.
  4. nkastanas 👍 1 Answered B
    D: This configuration still requires peering between the VPCs, which does not meet the requirement for full isolation between Department A and Department B.
  5. 832f53c 👍 1 Answered B
    A - High operational overhead C - Do not complete isolate D - Add complexity B is correct
  6. hamish88 👍 1
    I guess the "full isolation between the VPC networks" part rejects option D
  7. RKS_2021 👍 1 Answered D
    D is correct.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Resolve BGP Session Failures on Cloud Interconnect?

S-grade

Deploying Packet Mirroring Policies in GCP Regions

S-grade

Troubleshooting Asymmetric Traffic on Google Cloud Interconnect

S-grade

Which BGP Attribute Controls Active/Passive Hybrid Egress?

S-grade

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide