PCNE Implementing a Virtual Private Cloud Practice Question
Exhibit
$ gcloud compute firewall-rules describe allow-internal allows: - IPProtocol: tcp ports: - 0-65535 - IPProtocol: udp ports: - 0-65535 - IPProtocol: icmp direction: INGRESS disabled: false name: allow-internal network: default priority: 1000 sourceRanges: - 10.128.0.0/14 targetTags: - internal
Refer to the exhibit. A VM in the default VPC with tag 'internal' and IP 10.128.1.2 is unable to communicate with another VM with IP 10.132.0.3 and tag 'internal'. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The source range 10.128.0.0/14 does not include 10.132.0.3.
The firewall rule shown allows ingress traffic from source range 10.128.0.0/14, which covers IP addresses from 10.128.0.0 to 10.131.255.255. The destination VM with IP 10.132.0.3 is outside this range (10.132.0.3 is in 10.132.0.0/16, not within 10.128.0.0/14). Therefore, traffic from the source VM (10.128.1.2) to the destination VM (10.132.0.3) is blocked because the destination IP is not allowed by the rule's source range. Option D correctly identifies this. Option A is incorrect because the rule direction is ingress, which is correct for receiving traffic; the issue is the source range. Option B is incorrect because even though ICMP may be used, the fundamental problem is the IP range mismatch. Option C is incorrect because priority 1000 is valid and does not cause blocking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The rule only applies to ingress traffic.
Why it's wrong here
Ingress is the correct direction for inbound traffic; the rule is not misconfigured in direction.
- ✗
The rule only allows TCP and UDP, not ICMP.
Why it's wrong here
ICMP is explicitly allowed in the rule.
- ✗
The rule priority is too low.
Why it's wrong here
Priority 1000 is normal; lower numbers are higher priority, but this does not cause blocking.
- ✓
The source range 10.128.0.0/14 does not include 10.132.0.3.
Why this is correct
The source range excludes 10.132.0.3, blocking return traffic.
Go deeper
Related to this question
About these practice questions
One of 961 original PCNE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.