PCNE Implementing a Virtual Private Cloud Practice Question
A company has two VPC networks in the same project: 'vpc-a' (us-central1) and 'vpc-b' (us-east1). They are connected via VPC Network Peering. An instance in vpc-a can ping the internal IP of an instance in vpc-b, but cannot reach it on TCP port 8080. The firewall rule in vpc-b allows ingress from the peered network's subnets. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall rule for port 8080 is missing or uses an incorrect target tag or service account.
Since ICMP (ping) works, VPC Network Peering is functioning correctly, and the firewall rule in vpc-b allows ingress from the peered network's subnets. The failure on TCP 8080 indicates a missing or misconfigured firewall rule specific to that port, possibly due to incorrect target tags or service accounts. Option D is incorrect because the rule already permits ingress from the peered subnets; the issue is that no rule explicitly allows TCP 8080. Therefore, the most likely cause is that the firewall rule for port 8080 is missing or uses an incorrect target tag or service account, making option C correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The instance in vpc-b has a firewall rule that denies TCP port 8080 explicitly.
Why it's wrong here
There is no evidence of a deny rule; the symptom suggests the allow rule is not matching.
- ✗
The subnet in vpc-a is in a different region, so peering does not support cross-region communication.
Why it's wrong here
VPC Network Peering supports cross-region communication, so this is not the issue.
- ✓
The firewall rule for port 8080 is missing or uses an incorrect target tag or service account.
Why this is correct
Since ICMP works but TCP 8080 does not, the specific firewall rule for port 8080 is likely missing or misconfigured.
- ✗
The firewall rule in vpc-b must allow ingress from the entire CIDR of vpc-a's subnet, not just the peered network.
Why it's wrong here
Using the peered network as source is equivalent to the subnet CIDR; that is not the issue.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.