- A
The rule must be applied using network tags on instances in Subnet-A.
Why wrong: Tags are optional; the rule can also apply to all instances in the subnet via target tags or service accounts.
- B
The rule must be an ingress rule with source set to Subnet-A IP range and destination set to Subnet-B IP range.
To block traffic from A to B, the ingress rule on Subnet-B must block source A.
- C
The rule must have action set to 'deny' and apply to all instances in Subnet-B.
The rule must deny traffic and target the destination subnet instances.
- D
The rule must also allow return traffic from Subnet-B to Subnet-A.
Why wrong: Firewall rules are stateless; return traffic is not automatically allowed; separate rules are needed.
- E
The rule must have a lower priority number (higher priority) than any allow rules between the subnets.
Priority numbers: lower number = higher priority. Deny rules must outrank allow rules.
Quick Answer
The answer is that you must create an ingress deny rule on Subnet-B with a lower priority number than any allow rules between the subnets. This is correct because VPC firewall rules in Google Cloud are stateful and evaluated by priority, where a lower number means higher precedence; to block traffic between subnets, the deny rule must be applied as an ingress rule on the destination subnet (Subnet-B) with the source set to Subnet-A’s IP range, ensuring the rule intercepts incoming packets before any allow rule can match. On the Google Professional Cloud Network Engineer exam, this tests your understanding of firewall rule direction and priority ordering—a common trap is mistakenly applying an egress rule on Subnet-A or forgetting that deny rules must outrank conflicting allows. Remember the mnemonic: “Deny must fly higher with a lower number, and ingress is the gatekeeper on the destination subnet.”
PCNE Implementing a Virtual Private Cloud Practice Question
This PCNE practice question tests your understanding of implementing a virtual private cloud. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company has a VPC with multiple subnets. They want to restrict traffic between two subnets (Subnet-A and Subnet-B) using VPC firewall rules. Which THREE conditions must be met for a firewall rule to block traffic from Subnet-A to Subnet-B?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
The rule must be an ingress rule with source set to Subnet-A IP range and destination set to Subnet-B IP range.
Option B is correct because VPC firewall rules in Google Cloud are stateful and defined as ingress or egress rules. To block traffic from Subnet-A to Subnet-B, you need an ingress rule on Subnet-B (the destination) with the source set to Subnet-A's IP range and the destination set to Subnet-B's IP range. This ensures the rule applies to incoming traffic from Subnet-A, and the action 'deny' will drop the packets.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The rule must be applied using network tags on instances in Subnet-A.
Why it's wrong here
Tags are optional; the rule can also apply to all instances in the subnet via target tags or service accounts.
- ✓
The rule must be an ingress rule with source set to Subnet-A IP range and destination set to Subnet-B IP range.
Why this is correct
To block traffic from A to B, the ingress rule on Subnet-B must block source A.
Related concept
Read the scenario before looking for a memorised answer.
- ✓
The rule must have action set to 'deny' and apply to all instances in Subnet-B.
Why this is correct
The rule must deny traffic and target the destination subnet instances.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
The rule must also allow return traffic from Subnet-B to Subnet-A.
Why it's wrong here
Firewall rules are stateless; return traffic is not automatically allowed; separate rules are needed.
- ✓
The rule must have a lower priority number (higher priority) than any allow rules between the subnets.
Why this is correct
Priority numbers: lower number = higher priority. Deny rules must outrank allow rules.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the misconception that firewall rules must be applied to both subnets or that return traffic requires a separate rule, but Google Cloud's stateful firewall automatically handles return traffic for allowed connections, so only the blocking rule is needed.
Detailed technical explanation
How to think about this question
In Google Cloud VPC, firewall rules are evaluated in order of priority (lower number = higher priority). A deny rule with a higher priority (lower number) than any allow rule will take precedence and block traffic. The rule must be an ingress rule on the destination subnet because traffic flows from source to destination; egress rules on the source subnet could also block traffic, but the question specifies an ingress rule with source and destination IP ranges. Under the hood, Google Cloud uses a distributed firewall that enforces rules at the hypervisor level, ensuring low-latency packet filtering.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Implementing a Virtual Private Cloud — study guide chapter
Learn the concepts, then practise the questions
- →
Implementing a Virtual Private Cloud practice questions
Targeted practice on this topic area only
- →
All PCNE questions
497 questions across all exam domains
- →
Google Professional Cloud Network Engineer study guide
Full concept coverage aligned to exam objectives
- →
PCNE practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related PCNE practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Designing, planning, and prototyping a GCP network practice questions
Practise PCNE questions linked to Designing, planning, and prototyping a GCP network.
Implementing hybrid interconnectivity practice questions
Practise PCNE questions linked to Implementing hybrid interconnectivity.
Configuring network services practice questions
Practise PCNE questions linked to Configuring network services.
Implementing network security practice questions
Practise PCNE questions linked to Implementing network security.
Implementing a Virtual Private Cloud practice questions
Practise PCNE questions linked to Implementing a Virtual Private Cloud.
PCNE fundamentals practice questions
Practise PCNE questions linked to PCNE fundamentals.
PCNE scenario practice questions
Practise PCNE questions linked to PCNE scenario.
PCNE troubleshooting practice questions
Practise PCNE questions linked to PCNE troubleshooting.
Practice this exam
Start a free PCNE practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this PCNE question test?
Implementing a Virtual Private Cloud — This question tests Implementing a Virtual Private Cloud — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The rule must be an ingress rule with source set to Subnet-A IP range and destination set to Subnet-B IP range. — Option B is correct because VPC firewall rules in Google Cloud are stateful and defined as ingress or egress rules. To block traffic from Subnet-A to Subnet-B, you need an ingress rule on Subnet-B (the destination) with the source set to Subnet-A's IP range and the destination set to Subnet-B's IP range. This ensures the rule applies to incoming traffic from Subnet-A, and the action 'deny' will drop the packets.
What should I do if I get this PCNE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More PCNE practice questions
- An organization is migrating to Google Cloud and requires connectivity between their on-premises network and VPC. They p…
- A company is migrating on-premises DNS to Google Cloud. They have a hybrid network using Cloud VPN and want to resolve o…
- A network engineer is configuring a Cloud Router for BGP peering with an on-premises router over a VPN tunnel. The on-pr…
- A company uses Cloud NAT to allow private instances to reach the internet. They notice that egress traffic from Compute…
- Match each VPC networking concept to its definition.
- Drag and drop the steps to troubleshoot a VPN tunnel that is not passing traffic into the correct order.
Last reviewed: Jun 30, 2026
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.