PCNE Implementing a Virtual Private Cloud Practice Question
A company is designing a Shared VPC architecture for multiple projects. The host project hosts three VPC networks: 'prod', 'staging', 'dev'. Each service project needs access to a specific network. Some service projects require access to multiple networks. The security team wants to minimize the number of firewall rules and use IAM for centralized control. Which approach meets these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach each service project to one host project network and use IAM roles to grant access to specific subnets in other networks with a cross-project service account.
In Shared VPC, a service project can only be attached to one VPC network per host project. To provide access to multiple VPC networks, you can use IAM roles such as compute.networkUser on specific subnets across different host projects or use a cross-project service account. Option A allows each service project to be attached to one network and then grants IAM permissions to access subnets in other networks, meeting the requirement to minimize firewall rules and use IAM for centralized control. Option B (VPC peering) does not provide centralized IAM control. Option C (separate host projects) increases management overhead. Option D (single VPC) defeats the purpose of isolation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Attach each service project to one host project network and use IAM roles to grant access to specific subnets in other networks with a cross-project service account.
Why this is correct
This allows service projects to access multiple networks by using IAM on subnets and service accounts, minimizing firewall rules.
- ✗
Use VPC Network Peering between each service project's VPC and the host project's networks.
Why it's wrong here
Peering adds complexity and does not provide centralized IAM control; also, each service project needs its own VPC.
- ✗
Create a separate host project for each environment and attach service projects accordingly.
Why it's wrong here
This increases management overhead and does not minimize firewall rules.
- ✗
Create a single VPC network that encompasses all environments, and use subnet-level firewall rules to isolate environments.
Why it's wrong here
This does not provide separate VPC networks per environment, which may be a compliance requirement.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.