PCNE Implementing a Virtual Private Cloud Practice Question
Exhibit
NAME NETWORK DIRECTION PRIORITY ALLOW DENY default-allow-icmp my-vpc INGRESS 65534 icmp default-allow-ssh my-vpc INGRESS 65534 tcp:22 default-allow-rdp my-vpc INGRESS 65534 tcp:3389 allow-custom-internal my-vpc INGRESS 1000 tcp:80,443 deny-all-egress my-vpc EGRESS 1000 all
Refer to the exhibit. A VM in the my-vpc network is unable to reach an external HTTPS server. What is the most likely cause?
⚠ Common exam trap
Google Cloud often tests the misconception that a missing allow rule is the direct cause, rather than recognizing the explicit deny-all-egress rule with lowest priority as the actual blocking mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The deny-all-egress firewall rule blocks all outbound traffic.
The default VPC configuration includes a deny-all-egress firewall rule with the lowest priority (65535) that blocks all outbound traffic not explicitly allowed. Since no higher-priority rule permits outbound traffic to the external HTTPS server (port 443), the VM's HTTPS requests are dropped by this implicit deny rule, preventing connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The deny-all-egress firewall rule blocks all outbound traffic.
Why this is correct
This egress deny rule with priority 1000 blocks all outbound traffic, including HTTPS.
- ✗
The allow-custom-internal rule only allows inbound traffic.
Why it's wrong here
While true, this rule does not affect outbound traffic; the issue is due to the egress deny rule.
- ✗
No rule allows outbound traffic to port 443.
Why it's wrong here
This is a consequence of the deny-all-egress rule, but the root cause is the deny rule itself.
- ✗
The default-allow-ssh rule has a low priority.
Why it's wrong here
Priority is unrelated to the outbound connectivity issue; the rule is for ingress SSH.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.