How many Troubleshooting Scenario Questions questions are on this page?

This page has 9 Troubleshooting Scenario Questions scenario questions for the PCSE exam, each with detailed explanations and wrong-answer analysis.

How should I approach PCSE scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Google Professional Cloud Security Engineer questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Google Professional Cloud Security Engineer practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PCSE

exam code

Google Cloud

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

A GKE cluster has Workload Identity enabled. A Kubernetes service account is bound to a GCP service account named 'sa-gcs'. A pod using the Kubernetes service account fails to list objects in a Cloud Storage bucket. The GCP service account has the Storage Object Viewer role. What is the most likely cause?

A
The pod is using the wrong GCP service account.
Why wrong: If bound correctly, the pod uses the correct SA.
B
The bucket has uniform bucket-level access disabled.
Why wrong: Uniform bucket-level access does not affect permission errors.
C
The Kubernetes service account does not have the iam.workloadIdentityUser role on the GCP service account.
This role is required for the KSA to impersonate the GCP SA.
D
The GCP service account lacks the storage.objects.list permission.
Why wrong: Storage Object Viewer includes that permission.

Full breakdown with real-world context →

Question 2hardmulti select

Full question →

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

A
Check IAM permissions for the VM's service account
Why wrong: IAM permissions control API access, not network traffic; firewall rules are independent.
B
Check firewall rule logs in Cloud Logging
Firewall logs show allowed and denied connections, directly indicating blocking.
C
Verify that the network tags on instances match the target tags in the firewall rule
Firewall rules apply based on tags; mismatched tags cause traffic to be blocked.
D
Review VPC flow logs to see if traffic is reaching the VM
VPC flow logs show traffic metadata; if packets are dropped by firewall, flow logs may not show them.
E
Inspect the route tables for the subnet
Why wrong: Routes determine packet forwarding, not firewall filtering; blocking is due to firewall rules.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

A developer is troubleshooting a Cloud Run service that needs to read from a Cloud Storage bucket. The service runs as the compute engine default service account. The service account has been granted the Storage Object Viewer role at the project level, but the service still gets permission denied errors. What is the most likely cause?

A
The bucket uses uniform bucket-level access, which overrides IAM.
Why wrong: Uniform bucket-level access still uses IAM, so the role should work.
B
The service account was not granted access to the specific bucket.
Why wrong: The role is at project level, which applies to all buckets.
C
The Cloud Run service is using a different service account than the one modified.
Cloud Run services must have a service account explicitly assigned; it does not use the compute engine default SA.
D
The Cloud Run service requires the Storage Admin role.
Why wrong: Object Viewer is sufficient for reading objects.

Full breakdown with real-world context →

Question 4easymultiple choice

Full question →

A security analyst needs to investigate a potential breach in a Compute Engine instance. They want to create an offline forensic copy of the disk without affecting the running instance. Which action should they take?

A
Create an image from the disk while the instance is running.
Why wrong: Creating an image from a running disk may result in an inconsistent state, and images are used for creating new instances, not forensics.
B
Use the gcloud compute disks copy command to replicate the disk.
Why wrong: There is no disks copy command; you can create a snapshot or clone, but cloning requires stopping the instance.
C
Attach a new blank disk to the instance and use dd to clone the data.
Why wrong: Running dd on a live instance changes disk state and may contaminate evidence.
D
Stop the instance and create a snapshot of the boot disk.
Stopping ensures a consistent snapshot; the snapshot can be used for forensics without affecting the original instance.

Full breakdown with real-world context →

Question 5hardmultiple choice

Open the full BGP breakdown →

A company has a VPC network named 'production' with subnets in us-central1 and europe-west1. They have on-premises data centers in New York and London connected via two HA VPN gateways to the respective regions. The on-premises networks use BGP with Cloud Routers in each region. The company also has a Shared VPC with service projects. Recently, they migrated a critical application to Google Cloud, which runs on Compute Engine instances in the europe-west1 subnet. The application needs to communicate with an on-premises database in London reachable via the London VPN. After the migration, the application fails to connect to the database. The Cloud Router in europe-west1 shows that it is receiving the on-premises routes. The instance has a default route to the internet via Cloud NAT. The firewall rules allow all traffic from the instance to the on-premises IP range. What is the most likely cause of the connectivity issue?

A
The on-premises firewall is blocking traffic from the Google Cloud IP ranges.
Why wrong: Incorrect: the question states it's a route propagation issue, not firewall.
B
The Cloud NAT is incorrectly configured and blocking traffic to on-premises IP ranges.
Why wrong: Incorrect: Cloud NAT only applies to traffic with destination outside VPC, but on-premises ranges are not internet.
C
The Shared VPC configuration prevents service project instances from using VPC routes.
Why wrong: Incorrect: Shared VPC allows service project instances to use host project routes.
D
The Cloud Router in europe-west1 has dynamic route import from BGP disabled.
Correct: without dynamic route import, learned BGP routes are not added to the VPC route table.

Full breakdown with real-world context →

Question 6easymultiple choice

Review the full subnetting walkthrough →

A small company has a single VPC with subnets in us-central1 (10.0.1.0/24) and us-west1 (10.0.2.0/24). They have a Compute Engine VM (web-server) in us-central1 that needs to connect to a Cloud SQL MySQL instance also in us-central1 using its private IP address 10.0.1.3. The Cloud SQL instance is configured with private IP only and is deployed in the same VPC. The web-server can successfully ping the Cloud SQL private IP (10.0.1.3). However, the application on the web-server fails to connect to the MySQL database with an authentication error. There are no custom firewall rules; only the default VPC firewall rules are in place. What is the most likely cause of the connection failure?

A
The default-allow-internal firewall rule does not allow TCP port 3306.
Why wrong: The default rule allows all protocols and ports, including TCP 3306.
B
The web-server's service account lacks the Cloud SQL Client IAM role.
This role is necessary to authenticate to Cloud SQL; without it, the application fails with a permission error.
C
The Cloud SQL instance does not have the public IP address enabled.
Why wrong: Public IP is not required for private IP connectivity.
D
The Cloud SQL instance is in a different region than the web-server.
Why wrong: Both are in us-central1, as stated in the scenario.

Full breakdown with real-world context →

Question 7mediummultiple choice

Full question →

Refer to the exhibit. A security engineer runs the gcloud command to analyze IAM policy for a user in an organization. The output shows that the user has the 'compute.instances.create' permission via a role at the organization level. However, the user is unable to create Compute Engine instances in a specific project. What is the most likely cause?

Network Topology

A
The user does not have the 'compute.instances.create' permission at the project level.
Why wrong: The command shows the permission is granted at the organization level, which should be inherited.
B
The user has the permission but through a different role than expected.
Why wrong: The permission is present regardless of role.
C
An organization policy constraint is denying the creation of Compute Engine instances.
Organization policies can deny actions even if IAM allows them.
D
The user's role is not granted at the project level.
Why wrong: Organization-level roles are inherited by all projects.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

A security engineer is troubleshooting a connectivity issue between two VPCs connected via VPC Network Peering. VPC-A (project A) has a Compute Engine instance with internal IP 10.1.0.2. VPC-B (project B) has an instance with internal IP 10.2.0.2. The engineer has verified that the peering connection is active and the firewall rules allow ingress from 10.1.0.0/16. However, the instance in VPC-B cannot ping the instance in VPC-A. What is the most likely cause?

A
The VPC-A has a firewall rule that denies ICMP traffic from VPC-B.
Why wrong: The engineer verified firewall rules allow ingress from 10.1.0.0/16, so this is not the issue.
B
The VPC-B does not have a route to VPC-A's subnet ranges. Custom route exchange is not enabled on the peering connection.
By default, only subnet routes are exchanged. Custom routes require explicit export/import settings.
C
The MTU configuration on the peering connection is set too low.
Why wrong: MTU issues would cause fragmentation, not complete unreachability.
D
The instance in VPC-B does not have a public IP address.
Why wrong: Ping uses internal IPs; public IPs are not required for VPC peering.

Full breakdown with real-world context →

Question 9mediummultiple choice

Full question →

A user is unable to SSH into an instance that has the tag 'ssh-access' and an internal IP 10.0.0.2. The user's IP is 198.51.100.1. What is the most likely reason?

Exhibit

Refer to the exhibit.

```
$ gcloud compute firewall-rules describe allow-ssh
kind: compute#firewall
name: allow-ssh
network: default
direction: INGRESS
priority: 1000
sourceRanges:
- 203.0.113.0/24
allowed:
- IPProtocol: tcp
  ports:
  - '22'
targetTags:
- ssh-access
```

A
The instance is not using the correct service account
Why wrong: Service accounts are not relevant for network connectivity; they control API access.
B
The instance does not have an external IP
Why wrong: The instance has an internal IP, but SSH can be done via internal IP if within VPC or via VPN. The rule allows from a specific source range, not based on external IP.
C
The user's IP is not in the allowed source range
The rule's sourceRanges only includes 203.0.113.0/24, not the user's IP.
D
The firewall rule is disabled
Why wrong: The rule is described, and there is no indication it is disabled.

Full breakdown with real-world context →

These PCSE practice questions are part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style PCSE questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related PCSE topic practice pages

Configuring Access Within a Cloud Solution Environment practice questions

Ensuring Data Protection practice questions

Managing Operations in a Cloud Solution Environment practice questions

Configuring Network Security practice questions

Supporting Compliance Requirements practice questions

PCSE fundamentals practice questions

PCSE scenario practice questions

PCSE troubleshooting practice questions

Practice scenarios

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

A security analyst needs to investigate a potential breach in a Compute Engine instance. They want to create an offline forensic copy of the disk without affecting the running instance. Which action should they take?

A user is unable to SSH into an instance that has the tag 'ssh-access' and an internal IP 10.0.0.2. The user's IP is 198.51.100.1. What is the most likely reason?

Exhibit