PCNE Implementing VPC Instances Practice Question
A security team wants to enforce a policy that blocks all egress traffic to the internet from a specific set of VMs across multiple projects in an organization. The policy should be centrally managed and override VPC-level firewall rules. Which approach should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a hierarchical firewall policy at the organization level with a deny egress rule targeting the VMs.
Hierarchical firewall policies at the organization level can enforce rules that apply to all VPCs and override VPC-level rules with lower priority.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create VPC firewall rules with deny egress for the specific VMs in each VPC.
Why it's wrong here
VPC-level rules can be overridden by higher-priority rules and are not centrally managed across projects.
- ✓
Deploy a hierarchical firewall policy at the organization level with a deny egress rule targeting the VMs.
Why this is correct
Hierarchical firewall policies are centrally managed and can override VPC firewall rules.
- ✗
Use a network firewall policy attached to each VPC network.
Why it's wrong here
Network firewall policies apply per VPC and may not override VPC rules if not configured correctly, and they are not centralized at the org level.
- ✗
Configure Cloud Armor security policies on the load balancer to block egress.
Why it's wrong here
Cloud Armor policies apply to incoming traffic to load balancers, not egress from instances.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.