PCNE Configuring Network Services Practice Question
A DevOps team is configuring a VPC with a subnet in us-east1. They need to allow a specific VM (source IP 10.0.1.2) to access a database VM (destination IP 10.0.2.3) on port 3306, but only from that specific source. All other traffic should be denied. Which firewall rule configuration should they use?
⚠ Common exam trap
Test-takers frequently confuse ingress vs. egress rules or try to target a specific destination IP in a firewall rule, but GCP firewall rules only support targets via tags, service accounts, or the entire network, not by IP address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an ingress rule with priority 1000, action allow, source 10.0.1.2/32, protocol tcp:3306, target tags = db, and assign the 'db' tag to the database VM.
It creates an ingress firewall rule with the highest priority (1000 is the default for custom rules) that explicitly allows TCP traffic on port 3306 from source IP 10.0.1.2/32 to any VM tagged with 'db'. By assigning the 'db' tag to the database VM, the rule applies only to that target, and since VPC firewall rules are stateful, the corresponding return traffic is automatically allowed. All other traffic is denied by the implied deny-all rule (priority 65535), meeting the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an egress rule on the source VM's network interface allowing traffic to 10.0.2.3/32 on port 3306.
Why it's wrong here
Egress rules control outbound traffic, but the database VM needs an ingress rule to accept traffic.
- ✗
Create an ingress rule with priority 1000, action allow, source 10.0.1.2/32, protocol all, target service account = db-sa.
Why it's wrong here
This allows all protocols, which is overly permissive.
- ✓
Create an ingress rule with priority 1000, action allow, source 10.0.1.2/32, protocol tcp:3306, target tags = db, and assign the 'db' tag to the database VM.
Why this is correct
Ingress rule with specific source and port allows the required traffic when tag is assigned to destination VM.
- ✗
Create an ingress rule with priority 1000, action allow, source 10.0.1.2/32, protocol tcp:3306, target 10.0.2.3/32.
Why it's wrong here
Priority 1000 is lower than the implicit deny (65535), but default deny is lower? Actually implicit deny has priority 65535, so 1000 is higher priority, so it would be evaluated before. But the issue is that it targets an IP range, not a tag or service account; firewall rules can target tags or service accounts, not IP ranges directly. So this option is invalid because you can't target an IP address. Option A is invalid in practice; but for exam, we want plausible. Actually firewall rules can target tags, service accounts, or all instances. They cannot target by IP. So this option is wrong because syntax is incorrect. I'll adjust explanation.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.