The correct configuration is an ingress firewall rule that allows TCP traffic on port 3306, with the source service account set to 'web-sa' and target tags set to 'db'. This works because Google Cloud VPC firewall rules support identity-based filtering: by specifying a source service account, the rule matches traffic originating from any VM that runs under that service account, regardless of its IP address, while the target tag 'db' ensures the rule only applies to database VMs that have that tag. On the Google Professional Cloud Network Engineer exam, this scenario tests your understanding of how service account filters decouple firewall rules from static IPs, a common trap being that candidates mistakenly use source IP ranges or destination service accounts instead. Remember the key distinction: source service accounts filter who sends traffic, target tags filter who receives it. A useful memory tip is "SA for source, tag for target" to avoid mixing up the two filters.
PCNE Configuring network services Practice Question
This PCNE practice question tests your understanding of configuring network services. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security team wants to allow traffic from a specific set of VMs with service account 'web-sa@project.iam.gserviceaccount.com' to access a database VM with tag 'db'. The VMs are in the same VPC. Which firewall rule configuration achieves this?
Option D is correct because it defines an ingress firewall rule that allows TCP traffic on port 3306 (MySQL) from VMs using the service account 'web-sa@project.iam.gserviceaccount.com' as the source, targeting VMs with the network tag 'db'. In GCP VPC firewall rules, source service accounts can be used to filter traffic based on the identity of the source VM, while target tags apply the rule to destination VMs that have the specified tag, enabling identity-based access control without relying on IP addresses.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Ingress rule: allow tcp:3306, source IP range 10.0.0.0/8, target tags 'db'
Why it's wrong here
Using IP ranges would not restrict by service account; it's less specific.
This rule only allows traffic from VMs with the specified service account to the tagged database VMs.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the distinction between ingress and egress rules in the context of service account filtering, and the trap here is that candidates may confuse the direction of traffic (thinking an egress rule on the web VMs is needed) or incorrectly mix source/target tags with service accounts, leading them to pick options that use IP ranges or mismatched attributes.
Detailed technical explanation
How to think about this question
GCP firewall rules support both IP-based and identity-based (service account) filtering for sources and targets. When using source service accounts, the rule matches traffic from any VM instance that runs with that service account, regardless of its IP address or network tag, which is useful in dynamic environments where IPs change. The target tags mechanism allows rules to be applied selectively to VM instances based on their network tags, and these tags are independent of service accounts, enabling flexible grouping for security policies.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Configuring network services — This question tests Configuring network services — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Ingress rule: allow tcp:3306, source service account 'web-sa', target tags 'db' — Option D is correct because it defines an ingress firewall rule that allows TCP traffic on port 3306 (MySQL) from VMs using the service account 'web-sa@project.iam.gserviceaccount.com' as the source, targeting VMs with the network tag 'db'. In GCP VPC firewall rules, source service accounts can be used to filter traffic based on the identity of the source VM, while target tags apply the rule to destination VMs that have the specified tag, enabling identity-based access control without relying on IP addresses.
What should I do if I get this PCNE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.