Google PCA Manage and provision cloud infrastructure Practice Question
A company uses Shared VPC. A project admin in a service project tries to create a subnet in the shared VPC network but receives a permission denied error. What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the misconception that service project admins have full control over the shared network, when in reality they only have usage permissions unless explicitly granted administrative permissions on the host project.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service project admin lacks the compute.subnetworks.create permission on the host project.
In a Shared VPC architecture, subnet creation is a privileged operation that can only be performed by a user with the compute.subnetworks.create permission on the host project. The service project admin, by default, does not have this permission in the host project, which is why the permission denied error occurs. Granting this permission to the service project admin at the host project level would resolve the issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Only the Shared VPC host project admin can create subnets.
Why it's wrong here
The host project admin can grant subnet creation permissions to service project admins.
- ✓
The service project admin lacks the compute.subnetworks.create permission on the host project.
Why this is correct
Permission must be granted on the host project for subnet creation.
- ✗
The Shared VPC is not enabled for the service project.
Why it's wrong here
If not enabled, the error would be different; permission denied indicates lack of IAM.
- ✗
Subnets must be created in the service project, not the host project.
Why it's wrong here
Shared VPC subnets are created in the host project.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Compute Options Overview
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
About these practice questions
One of 955 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.