hardMultiple SelectObjective-mapped
Required Components for Configuring VPC Flow Logs
Which THREE components are required to configure VPC Flow Logs for a Compute Engine instance?
Quick Answer
The answer is a VM with a network interface in the subnet, the subnet itself with flow logs enabled, and the VM’s service account with the compute.instances.get permission. VPC Flow Logs capture network traffic metadata at the subnet level, so enabling flow logs on the subnet is the primary configuration step that activates logging for all VM instances within that subnet. The VM’s service account must have the compute.instances.get permission to allow the flow log agent to retrieve instance metadata required for log entries, and a VM with a network interface in the subnet is necessary because flow logs are generated per network interface—without a VM in the subnet, there is no traffic to log. On the Google Professional Cloud Security Engineer exam, this tests your understanding that flow logs are subnet-scoped, not instance-scoped, and a common trap is forgetting the service account permission or assuming the VM itself is the configuration target. Memory tip: think “Subnet, Service Account, and a VM inside it” as the three pillars of flow log setup.
⚠ Common exam trap
Google Cloud often tests the misconception that a log sink or external export destination is a required component for VPC Flow Logs, when in fact the logs are natively stored in Cloud Logging and exporting is optional.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable VPC Flow Logs on the subnet
VPC Flow Logs capture network traffic metadata at the subnet level. Enabling flow logs on the subnet (A) is the primary configuration step that activates logging for all VM instances within that subnet. The VM's service account must have the compute.instances.get permission (B) to allow the flow log agent to retrieve instance metadata required for log entries. A VM with a network interface in the subnet (D) is necessary because flow logs are generated per network interface; without a VM in the subnet, there is no traffic to log.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable VPC Flow Logs on the subnet
Why this is correct
Flow logs are enabled per subnet.
- ✓
The VM's service account must have the compute.instances.get permission
Why this is correct
Required to retrieve logs for the instance.
- ✗
A log sink to export logs to BigQuery
Why it's wrong here
Optional, not required for enabling flow logs.
- ✓
A VM with a network interface in the subnet
Why this is correct
Traffic to/from that interface is logged.
- ✗
A metadata server to store logs
Why it's wrong here
Logs are stored in Cloud Logging, not metadata server.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCSE question is part of Courseiva's 960-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCSE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are required to enable VPC Flow Logs for a subnet? (Choose THREE.)
hard- ✓ A.A subnet in the VPC
- ✓ B.Setting the subnet's flow logs configuration to ON
- ✓ C.A VPC network
- D.A sample rate
- E.An aggregation interval
Why A: A subnet in the VPC is required because VPC Flow Logs capture IP traffic metadata at the subnet level. Without a subnet, there is no network segment to monitor, as flow logs are associated with a specific subnet within a VPC.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.