PCNE Implementing a Virtual Private Cloud Practice Question
An organization uses a custom mode VPC with several subnets. They need to add a new subnet 192.168.1.0/24 for a new workload. After creating the subnet, they find that existing firewall rules with target tags don't apply to instances in the new subnet, even though the tags are applied. What is the most likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall rules have a source or destination filter that excludes the new subnet's CIDR.
In Google Cloud, firewall rules can include source or destination IP range filters. Even if target tags match, if the rule also specifies a source or destination range that does not include the new subnet's CIDR (192.168.1.0/24), the rule will not apply to instances in that subnet. Option A is incorrect because although firewall rules are scoped to the VPC, that does not explain the issue; the rules still apply to all subnets, but specific IP range filters can limit applicability. Option B is incorrect because there is no concept of 'firewall rule enforcement' on subnets. Option C is incorrect because firewall rule changes apply immediately; instances do not need to be recreated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Firewall rules are scoped to a VPC, not to subnets.
Why it's wrong here
That is true but does not cause the issue; tags work across subnets within the same VPC.
- ✗
The new subnet was created without enabling firewall rule enforcement.
Why it's wrong here
There is no such setting in Google Cloud.
- ✗
The instances need to be recreated for the new rules to apply.
Why it's wrong here
Firewall rules apply to existing instances without restart.
- ✓
The firewall rules have a source or destination filter that excludes the new subnet's CIDR.
Why this is correct
If a rule includes an IP range filter, it will only apply to traffic that matches that range.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.