PCNE Implementing a Virtual Private Cloud Practice Question
A small company has a single VPC with one subnet in us-central1 (10.0.1.0/24). They have a Compute Engine instance that needs to be reachable from the internet via HTTP (port 80) and HTTPS (port 443). The instance has an external IP address (ephemeral). They have created firewall rules allowing ingress on TCP 80 and 443 from 0.0.0.0/0, with target tags 'web-server'. The instance has been assigned the tag 'web-server'. However, external users report that they cannot access the instance's public IP on either port. The instance's OS firewall (iptables) is default allow. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The instance's external IP is ephemeral and may have changed, so users should use the new IP or reserve a static IP.
The VPC automatically has a default route to the internet gateway, so no custom route is needed. Firewall rules with target tags 'web-server' are correctly applied to the instance with that tag. The instance's OS firewall (iptables) is default allow, so it is not blocking traffic. The most likely cause is that the instance's external IP is ephemeral and may have changed after a stop/start operation. Users may be attempting to connect to the old IP address. To resolve this, the company should assign a static external IP to the instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The instance's external IP is ephemeral and may have changed, so users should use the new IP or reserve a static IP.
Why this is correct
Ephemeral IPs can change, causing connectivity issues; a static IP is recommended.
- ✗
The instance's OS firewall is blocking the traffic; check iptables.
Why it's wrong here
The OS firewall is default allow, so this is unlikely.
- ✗
The VPC needs a custom route for the internet gateway.
Why it's wrong here
The default route already exists.
- ✗
The firewall rules must be applied to the subnet, not the instance tag.
Why it's wrong here
Using tags is a valid method to apply firewall rules.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.