PCNE Practice Question: Designing, Planning, and Prototyping a GCP Network
Your company is deploying a multi-tier web application on Google Kubernetes Engine (GKE) with a regional cluster. You need to design network policies to allow traffic only from the frontend pods to the backend pods on port 8080. Which of the following is the most secure and recommended approach?
⚠ Common exam trap
Watch out — candidates often confuse VPC firewall rules (which control traffic at the node level) with Kubernetes NetworkPolicy (which controls traffic at the pod level), leading them to choose option C, even though pod IPs are ephemeral and not directly manageable via VPC firewall rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define a Kubernetes NetworkPolicy that allows ingress to backend pods from frontend pods on port 8080.
A Kubernetes NetworkPolicy is the native and most secure way to control pod-to-pod traffic within a GKE cluster. By defining an ingress rule that allows traffic only from frontend pods (selected via pod labels) to backend pods on TCP port 8080, you enforce micro-segmentation at the pod level, which is the recommended practice for multi-tier applications. This approach works regardless of the underlying node or VPC configuration and is fully integrated with GKE's network policies engine (Calico or Cilium).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Define a Kubernetes NetworkPolicy that allows ingress to backend pods from frontend pods on port 8080.
Why this is correct
NetworkPolicy is the native Kubernetes mechanism for pod-level traffic control.
- ✗
Configure Private Service Connect to restrict access to backend pods.
Why it's wrong here
Private Service Connect is for private access to managed services, not pod isolation.
- ✗
Create VPC firewall rules to allow ingress from frontend pods to backend pods on port 8080.
Why it's wrong here
VPC firewall rules apply to VM instances, not Kubernetes pods.
- ✗
Use Cloud Armor security policies to restrict traffic to backend pods.
Why it's wrong here
Cloud Armor is for HTTP(S) load balancing, not pod-to-pod traffic.
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.