PCNE Implementing a Virtual Private Cloud Practice Question
A large enterprise has a Google Cloud environment with multiple projects under an organization. They have a Shared VPC host project with a VPC named 'shared-vpc' that has subnets in us-central1 and europe-west1. Several service projects are attached to this host project. One service project, 'proj-analytics', has a Compute Engine instance 'vm-analytics' in us-central1 that needs to connect to a Cloud SQL PostgreSQL instance (private IP) also in us-central1, but within a different service project 'proj-db'. The Cloud SQL instance is configured with a private IP address 10.0.1.5 from a subnet in 'shared-vpc' (the same VPC). The vm-analytics instance has an internal IP 10.0.0.5 from a different subnet in 'shared-vpc'. The two subnets are in the same region, and there is a firewall rule allowing all traffic from 10.0.0.0/16 (the entire VPC range) to the Cloud SQL subnet. However, vm-analytics cannot connect to the Cloud SQL instance. The error on vm-analytics is 'Connection timed out'. There are no firewall rules blocking egress from vm-analytics. What is the most likely cause and solution?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the service project's compute engine default service account the Compute Network User role on the host project.
The most likely cause is that the service project's Compute Engine default service account lacks the necessary IAM permissions to use the Shared VPC network resources. The Cloud SQL instance with a private IP is accessible via the Shared VPC, but the service project's instances need the Compute Network User role on the host project to allow them to use the VPC network and its subnets. Without this role, the traffic from vm-analytics cannot reach the Cloud SQL private IP, resulting in a timeout. Option A is correct because granting the Compute Network User role to the service project's default compute service account enables the necessary network access. Option B is incorrect because Private Google Access is for accessing Google APIs without external IPs, not for Cloud SQL private connectivity. Option C is unnecessary because firewall rules already allow traffic from the entire VPC range to the Cloud SQL subnet. Option D is incorrect because Cloud Router is used for hybrid connectivity and dynamic routing, but the issue is IAM, not routing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Grant the service project's compute engine default service account the Compute Network User role on the host project.
Why this is correct
Without this role, the service project's instances cannot use the VPC resources, including the VPC peering routes to Cloud SQL.
- ✗
Enable Private Google Access on the vm-analytics subnet.
Why it's wrong here
Private Google Access enables outbound connections from a VM to Google APIs and services using external IPs, but the Cloud SQL instance here uses a private IP (10.0.1.5) reachable only over internal VPC routing. The error is a timeout, indicating packets are not reaching the Cloud SQL subnet, likely because the two service projects' subnets are in different Shared VPC service projects without proper VPC peering or firewall rules allowing inter-subnet traffic within the same VPC. This option is tempting because Private Google Access is commonly used to allow VMs without external IPs to reach Google-managed services, but it applies only to public API endpoints, not to private IP connections within the same VPC.
- ✗
Create a firewall rule in the host project allowing ingress from the service project's subnets to the Cloud SQL subnet.
Why it's wrong here
The firewall rule already exists allowing all traffic from the VPC range, so this is not the issue.
- ✗
Configure a Cloud Router in the service project to advertise routes to the Cloud SQL subnet.
Why it's wrong here
Cloud Router is not needed; the VPC peering handles routes.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.