PCNE Configuring Network Services Practice Question
A security team wants to allow traffic from a specific set of VMs with service account 'web-sa@project.iam.gserviceaccount.com' to access a database VM with tag 'db'. The VMs are in the same VPC. Which firewall rule configuration achieves this?
⚠ Common exam trap
Google Cloud often tests the distinction between ingress and egress rules in the context of service account filtering, and the trap here is that candidates may confuse the direction of traffic (thinking an egress rule on the web VMs is needed) or incorrectly mix source/target tags with service accounts, leading them to pick options that use IP ranges or mismatched attributes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ingress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'
It defines an ingress firewall rule that allows TCP traffic on port 3306 (MySQL) from VMs using the service account 'web-sa@project.iam.gserviceaccount.com' as the source, targeting VMs with the network tag 'db'. In GCP VPC firewall rules, source service accounts can be used to filter traffic based on the identity of the source VM, while target tags apply the rule to destination VMs that have the specified tag, enabling identity-based access control without relying on IP addresses.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ingress rule: allow tcp:3306, source IP range 10.0.0.0/8, target tags 'db'
Why it's wrong here
Using IP ranges would not restrict by service account; it's less specific.
- ✗
Ingress rule: allow tcp:3306, source tags 'web', target service account 'db-sa'
Why it's wrong here
Target service account is for the destination VM's identity, not the source; source tags are used instead of service accounts.
- ✗
Egress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'
Why it's wrong here
Egress rules control outbound traffic, not inbound; the direction is wrong.
- ✓
Ingress rule: allow tcp:3306, source service account 'web-sa', target tags 'db'
Why this is correct
This rule only allows traffic from VMs with the specified service account to the tagged database VMs.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.