PCNE Practice Question: Designing, Planning, and Prototyping a GCP Network

Exhibit

Refer to the exhibit.

```
gcloud compute networks subnets describe subnet-a --region us-central1
creationTimestamp: '2024-01-15T10:00:00.000-08:00'
description: ''
enableFlowLogs: false
gatewayAddress: 10.0.0.1
id: '123456789'
ipCidrRange: 10.0.0.0/24
kind: compute#subnetwork
logConfig: null
name: subnet-a
network: https://www.googleapis.com/compute/v1/projects/my-project/global/networks/vpc-1
privateIpGoogleAccess: false
purpose: PRIVATE
region: https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1
role: null
secondaryIpRanges: []
selfLink: https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/subnetworks/subnet-a
state: READY
```

A network engineer is troubleshooting connectivity from a Compute Engine instance in subnet-a to a Google Cloud Storage bucket. The instance has no external IP address. Based on the exhibit, what is the most likely cause of the connectivity issue?

⚠ Common exam trap

Watch out — candidates often assume a private subnet inherently blocks all external traffic, but Private Google Access is a separate, optional subnet setting that must be explicitly enabled for instances without external IPs to reach Google APIs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Private Google Access is disabled on the subnet.

The instance has no external IP address, so it must use Private Google Access to reach Google APIs and services like Cloud Storage. Private Google Access is enabled at the subnet level; if it is disabled, the instance cannot route traffic to the Google API VIPs through the default route (0.0.0.0/0) without a NAT gateway or external IP. Option B correctly identifies this as the most likely cause.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The subnet purpose is PRIVATE, which blocks Google APIs.
Why it's wrong here
Purpose PRIVATE is standard for regular subnets.
✓
Private Google Access is disabled on the subnet.
Why this is correct
Private Google Access must be enabled for instances without external IPs to access Google APIs.
✗
The subnet CIDR range is too small.
Why it's wrong here
The /24 range is sufficient for typical use.
✗
Flow logs are disabled, so traffic is not logged.
Why it's wrong here
Flow logs are for monitoring, not enabling connectivity.

Visual reference

Go deeper

PCNE Practice Question: Designing, Planning, and Prototyping a GCP Network

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question