Question 84 of 961
Shared VPC Subnet Access — Missing compute.networkUser Role
An organization uses Shared VPC with multiple service projects. They want to allow a service project to create a VM in a subnet that belongs to the host project. The subnet has an IAM policy that grants the compute.instanceAdmin role to the service project's service account. However, the service project is unable to create VMs in that subnet. What is the most likely reason?
Quick Answer
The answer is that the service project is missing the compute.networkUser role on the host project. This is required because Shared VPC architecture separates network resources (owned by the host project) from compute resources (owned by service projects); even if a subnet’s IAM policy grants compute.instanceAdmin to a service project’s service account, that account still needs the compute.networkUser role at the host project level to attach the subnet’s network interface to a VM. On the Google Professional Cloud Network Engineer exam, this scenario tests your understanding of the layered permission model in Shared VPC, where subnet-level IAM controls access to a specific subnet, but the host-project-level role is the gatekeeper for using any subnet in that VPC. A common trap is assuming subnet IAM alone is sufficient, but the networkUser role is the foundational prerequisite. Memory tip: think “NetworkUser first, then subnet IAM” — you must be invited to the network before you can use a specific room.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service project is missing the compute.networkUser role on the host project.
In Shared VPC, a service project must have the compute.networkUser role on the host project to use its networks. Without this role, subnet-level IAM permissions (like compute.instanceAdmin) are ineffective because the service project cannot even access the network. Therefore, even though the subnet IAM may be correctly configured, the missing networkUser role prevents VM creation. Option D is correct. Option A is incorrect because the subnet IAM policy is not the issue; the problem is at the host project level. Option B is incorrect because IP exhaustion would give a different error (e.g., IP space full), not a permission error. Option C is incorrect because the service project's own IAM roles are irrelevant for accessing host project resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The subnet IAM policy does not include the service project's service account.
Why it's wrong here
The subnet IAM policy may include the service account, but without the compute.networkUser role on the host project, VM creation fails. This is not the most likely reason.
- ✗
The subnet is out of IP addresses.
Why it's wrong here
IP address exhaustion would cause a different error, not a permission issue.
- ✗
The service project does not have the compute.instanceAdmin role on itself.
Why it's wrong here
The service project does not need compute.instanceAdmin on itself to use host project subnets; it needs permissions on the host project.
- ✓
The service project is missing the compute.networkUser role on the host project.
Why this is correct
The compute.networkUser role on the host project is required for using Shared VPC networks. Its absence is the most likely cause.
Visual reference
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization uses Shared VPC with multiple service projects. They want to ensure that only certain service projects can use a specific subnet. How can this be achieved?
hard- A.Use VPC subnet secondary IP ranges.
- ✓ B.Use IAM roles on the subnet to grant access to specific service projects.
- C.Use VPC Network Tags on the VM instances.
- D.Use VPC firewall rules with service accounts to restrict access.
Why B: Shared VPC subnet-level IAM allows granting access to specific service projects. Option A is incorrect because secondary IP ranges are used for IP address management, not for controlling project access. Option C is incorrect because network tags are primarily used for firewall rules, not subnet permissions. Option D is incorrect because firewall rules with service accounts control traffic flow, not which service projects can use a subnet.
Last reviewed: Jun 24, 2026
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.