PCNE Implementing network security Practice Question

A network engineer notices that VPC Flow Logs show connections from a Compute Engine instance to an IP address that should have been blocked by firewall rules. What is the most likely cause?

⚠ Common exam trap

Google Cloud often tests the misconception that firewall rules are automatically applied to all instances in a VPC, when in reality they must be explicitly associated via target tags or service accounts, and candidates may overlook the tag mismatch as the root cause.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The firewall rule is not applied to the instance's network tag.

If a firewall rule is not applied to the instance's network tag, the rule will not affect that instance. In Google Cloud, firewall rules can target instances by specifying target tags; if the rule's target tag does not match the instance's tag, the rule is not enforced on that instance, allowing traffic that should have been blocked.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The firewall rule has a lower priority than a deny rule.
Why it's wrong here
A lower priority rule would not override a higher priority rule; it would be ignored.
✗
The instance is using an external IP.
Why it's wrong here
External IP doesn't bypass firewall rules.
✗
VPC Flow Logs are inaccurate.
Why it's wrong here
VPC Flow Logs are reliable for connection data.
✓
The firewall rule is not applied to the instance's network tag.
Why this is correct
If the instance doesn't have the required tag, the firewall rule doesn't apply.

Go deeper

PCNE Implementing network security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question