PDE Practice Question: A Dataflow batch job fails consistently with the…

Exhibit

Refer to the exhibit.

```
# error log from Dataflow job
Worker failed to start: Operation timed out after 30.0 seconds.
Possible causes:
- Insufficient CPU quota in the region.
- Networking issues preventing VM creation.
- Stale custom image.
- gRPC connection failure to the Dataflow service.
```

A Dataflow batch job fails consistently with the error shown. The job uses a custom container image and runs in a VPC with a private IP. What should the engineer do to resolve the issue?

⚠ Common exam trap

It's easy for candidates to assume the error is due to the container image or SDK version, overlooking the VPC networking prerequisites (Private Google Access and Cloud NAT) that are required for Dataflow jobs using private IPs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Verify that the VPC has Private Google Access enabled and that Cloud NAT is configured for outbound internet access if needed.

The error indicates that the Dataflow batch job cannot access required resources (e.g., container image, dependencies) because the VPC with private IPs lacks outbound internet connectivity. Option B is correct because enabling Private Google Access allows the VMs to reach Google APIs (like Container Registry) via the Google network, and Cloud NAT provides outbound internet access for non-Google APIs or external dependencies. Without these, the job fails to pull the custom container image or download necessary artifacts.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Request a CPU quota increase in the region.
Why it's wrong here
CPU quota exhaustion surfaces as resource-related errors, yet the stem's private-IP VPC detail indicates a networking or egress problem instead. Requesting quota is the right action when the job fails with insufficient CPU or worker startup errors in the region.
✓
Verify that the VPC has Private Google Access enabled and that Cloud NAT is configured for outbound internet access if needed.
Why this is correct
Private Google Access lets the private-IP subnet reach Google APIs and services without external addresses, satisfying the job's dependency on those endpoints. Cloud NAT supplies outbound internet access for the custom container image's external pulls, since instances lacking public IPs cannot otherwise reach the registry.
✗
Rebuild the custom container image and upload it to Container Registry.
Why it's wrong here
Rebuilding the image does not address the failure, which stems from the private-IP VPC lacking egress to reach the registry or dependencies; the image itself is unchanged. It tempts because stale or missing layers do break jobs, so rebuilding is the right fix when the error is an image-pull or layer problem.
✗
Check that the custom image is based on the latest Dataflow SDK version.
Why it's wrong here
A custom container image with an outdated SDK can cause compatibility failures, but the stem's private-IP VPC detail points to missing Private Google Access or egress, not SDK versioning. Updating the SDK is correct when errors cite deprecated APIs or version mismatches.

Visual reference

Go deeper

PDE Practice Question: A Dataflow batch job fails consistently with the…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question