PCNE Implementing a Virtual Private Cloud Practice Question
A company has a VPC with three tiers: web, app, and db. They want to enforce that only the web tier can communicate with the app tier on TCP port 8080, and only the app tier can communicate with the db tier on TCP port 3306. All instances are in the same region but different subnets. Which TWO firewall rules should be created? (Choose 2.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An ingress rule on the db tier instances with tag 'db' allowing TCP 3306 from instances with tag 'app'.
To control traffic between tiers, ingress firewall rules should be applied to the destination instances using target tags. For web-to-app (TCP 8080), place an ingress rule on app instances (tag 'app') allowing TCP 8080 from source tag 'web' (Option D). For app-to-db (TCP 3306), place an ingress rule on db instances (tag 'db') allowing TCP 3306 from source tag 'app' (Option A). Option B is an egress rule on web, which controls outbound traffic but does not prevent other sources from reaching app. Option C allows traffic to any destination, violating the principle of least privilege. Option E incorrectly places an ingress rule on the web subnet, but the web tier should be the source, not the destination. Therefore, the correct answers are A and D.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An ingress rule on the db tier instances with tag 'db' allowing TCP 3306 from instances with tag 'app'.
Why this is correct
This ensures only app tier can reach db tier on port 3306.
- ✗
An egress rule on the web instances with tag 'web' allowing TCP 8080 to the app subnet.
Why it's wrong here
Egress rules control outbound traffic, but the requirement is to control ingress into app and db tiers; ingress rules are more direct.
- ✗
An egress rule on the web subnet allowing TCP 8080 to any destination.
Why it's wrong here
This does not restrict which tier can communicate; it allows all egress on port 8080, not just to app.
- ✓
An ingress rule on the app tier instances with tag 'app' allowing TCP 8080 from instances with tag 'web'.
Why this is correct
This ensures only web tier can reach app tier on port 8080.
- ✗
An ingress rule on the web subnet allowing TCP 8080 from the app subnet.
Why it's wrong here
This allows app to communicate with web on 8080, which is the opposite direction.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.