How should I use these Troubleshooting practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Troubleshooting questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Troubleshooting domain.

PCSE · topic practice

Troubleshooting practice questions

Practise Google Professional Cloud Security Engineer Troubleshooting practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

7 questionsDomain: Troubleshooting

Practice 10 questions Browse domain →

What the exam tests

What to know about Troubleshooting

Troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Troubleshooting exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Troubleshooting questions

7 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full NAT/PAT explanation →

A security engineer is troubleshooting an issue where a Compute Engine VM cannot connect to a Cloud SQL instance that has a private IP address. Both resources are in the same VPC network. The VM's firewall rules allow egress to any destination, and the Cloud SQL instance's authorized networks include the VPC network. What is the most likely cause of the connection failure?

Trap 1: Private Google Access is not enabled on the subnet.

Private Google Access is for accessing Google APIs without public IP, not for Cloud SQL private IP connectivity.

Trap 2: The VM's firewall rules block traffic to the Cloud SQL IP range.

The firewall rules allow egress to any destination, so this is not the cause.

Trap 3: The Cloud SQL instance requires the Cloud SQL Auth proxy to be…

The Cloud SQL Auth proxy is an alternative for connecting over public IP or IAM-based auth, but not required for private IP connectivity.

Study all Troubleshooting common traps →

A
Private Google Access is not enabled on the subnet.
Why wrong: Private Google Access is for accessing Google APIs without public IP, not for Cloud SQL private IP connectivity.
B
The VM's firewall rules block traffic to the Cloud SQL IP range.
Why wrong: The firewall rules allow egress to any destination, so this is not the cause.
C
The VPC network does not have a private services access connection (VPC peering) to the Service Networking API.
Private services access requires a VPC peering connection to route traffic to Google-managed services like Cloud SQL.
D
The Cloud SQL instance requires the Cloud SQL Auth proxy to be installed on the VM.
Why wrong: The Cloud SQL Auth proxy is an alternative for connecting over public IP or IAM-based auth, but not required for private IP connectivity.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full Troubleshooting explanation →

A security engineer is troubleshooting a connectivity issue between two VPCs connected via VPC Network Peering. VPC-A (project A) has a Compute Engine instance with internal IP 10.1.0.2. VPC-B (project B) has an instance with internal IP 10.2.0.2. The engineer has verified that the peering connection is active and the firewall rules allow ingress from 10.1.0.0/16. However, the instance in VPC-B cannot ping the instance in VPC-A. What is the most likely cause?

Trap 1: The VPC-A has a firewall rule that denies ICMP traffic from VPC-B.

The engineer verified firewall rules allow ingress from 10.1.0.0/16, so this is not the issue.

Trap 2: The MTU configuration on the peering connection is set too low.

MTU issues would cause fragmentation, not complete unreachability.

Trap 3: The instance in VPC-B does not have a public IP address.

Ping uses internal IPs; public IPs are not required for VPC peering.

Study all Troubleshooting common traps →

A
The VPC-A has a firewall rule that denies ICMP traffic from VPC-B.
Why wrong: The engineer verified firewall rules allow ingress from 10.1.0.0/16, so this is not the issue.
B
The VPC-B does not have a route to VPC-A's subnet ranges. Custom route exchange is not enabled on the peering connection.
By default, only subnet routes are exchanged. Custom routes require explicit export/import settings.
C
The MTU configuration on the peering connection is set too low.
Why wrong: MTU issues would cause fragmentation, not complete unreachability.
D
The instance in VPC-B does not have a public IP address.
Why wrong: Ping uses internal IPs; public IPs are not required for VPC peering.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Troubleshooting explanation →

A security engineer is troubleshooting access to a Cloud Storage bucket. The bucket has uniform bucket-level access enabled. The engineer's user account has the roles/storage.objectViewer role at the project level, but they get a 403 error when trying to download an object. What is the most likely cause?

Trap 1: The bucket has ACLs that override the IAM role.

Uniform bucket-level access disables ACLs.

Trap 2: The user does not have the storage.objects.get permission.

roles/storage.objectViewer includes storage.objects.get.

Trap 3: The user's project-level role does not apply to this specific…

Project-level roles apply to all resources in the project.

Study all Troubleshooting common traps →

A
The bucket has ACLs that override the IAM role.
Why wrong: Uniform bucket-level access disables ACLs.
B
The user does not have the storage.objects.get permission.
Why wrong: roles/storage.objectViewer includes storage.objects.get.
C
The user's project-level role does not apply to this specific bucket.
Why wrong: Project-level roles apply to all resources in the project.
D
There is a deny rule in an Organization Policy or an IAM deny policy that blocks the user.
Deny rules take precedence over allow rules, causing the 403 error.

Full breakdown with real-world context →

Question 4hardmultiple choice

Read the full Troubleshooting explanation →

Refer to the exhibit. A security administrator is troubleshooting why a user cannot access a BigQuery dataset. The user analyst@example.com is not a member of data-team@example.com. The user is trying to query a table in the dataset. What is the most likely reason for the denial?

Exhibit

{
  "bindings": [
    {
      "role": "roles/bigquery.dataViewer",
      "members": [
        "user:analyst@example.com"
      ]
    },
    {
      "role": "roles/bigquery.dataOwner",
      "members": [
        "group:data-team@example.com"
      ]
    }
  ],
  "etag": "ABC"
}

Trap 1: The user needs to be added as a dataOwner to query tables.

dataUser would suffice; dataOwner is not necessary.

Trap 2: The dataset policy includes a condition that the user does not…

There is no condition in the policy.

Trap 3: The table itself might have additional restrictions such as…

While possible, the most likely reason is the insufficient role, as the user only has dataViewer.

Study all Troubleshooting common traps →

A
The user needs to be added as a dataOwner to query tables.
Why wrong: dataUser would suffice; dataOwner is not necessary.
B
The user has the role roles/bigquery.dataViewer, which does not allow querying tables; it only allows viewing dataset metadata.
dataViewer is insufficient for querying.
C
The dataset policy includes a condition that the user does not satisfy.
Why wrong: There is no condition in the policy.
D
The table itself might have additional restrictions such as row-level security.
Why wrong: While possible, the most likely reason is the insufficient role, as the user only has dataViewer.

Full breakdown with real-world context →

Question 5mediummultiple choice

Review the full subnetting walkthrough →

A security engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but in different subnets. Both instances have internal IPs and are in the same region. The firewall rules allow ingress from 10.0.0.0/8. However, traffic is failing. What is the most likely cause?

Trap 1: The instances are using external IPs and the source IP is being…

Internal IPs are used, so NAT is not involved.

Trap 2: The VPC has dynamic routing mode set to global, causing routing…

Global routing mode does not affect intra-region traffic.

Trap 3: There is a firewall rule with a lower priority that denies egress…

By default egress is allowed; a deny rule would need to be explicitly created.

Study all Troubleshooting common traps →

A
The instances are using external IPs and the source IP is being NATed.
Why wrong: Internal IPs are used, so NAT is not involved.
B
The VPC has dynamic routing mode set to global, causing routing conflicts.
Why wrong: Global routing mode does not affect intra-region traffic.
C
The ingress firewall rule is applied to a network tag that is not assigned to the destination instances.
Firewall rules are applied to instances via tags or service accounts; missing tag would block traffic.
D
There is a firewall rule with a lower priority that denies egress traffic between subnets.
Why wrong: By default egress is allowed; a deny rule would need to be explicitly created.

Full breakdown with real-world context →

Question 6easymultiple choice

Review the full subnetting walkthrough →

A security engineer is troubleshooting a VPC firewall rule that is not allowing traffic from a specific subnet to a Compute Engine instance. The target tag is set correctly. What is the most likely cause?

Trap 1: The firewall rule is in the wrong network.

The rule is in the same network as the instance, otherwise the instance would not be reachable at all.

Trap 2: The instance has an internal IP address that is not within the…

The source range applies to the source of the traffic, not the instance's IP.

Trap 3: The firewall rule's target tag is misspelled.

The problem states the target tag is set correctly.

Study all Troubleshooting common traps →

A
A deny rule with a higher priority (lower number) exists and blocks the traffic.
A deny rule with lower priority number overrides allow rules of higher priority number.
B
The firewall rule is in the wrong network.
Why wrong: The rule is in the same network as the instance, otherwise the instance would not be reachable at all.
C
The instance has an internal IP address that is not within the source range of the rule.
Why wrong: The source range applies to the source of the traffic, not the instance's IP.
D
The firewall rule's target tag is misspelled.
Why wrong: The problem states the target tag is set correctly.

Full breakdown with real-world context →

Question 7hardmulti select

Read the full Troubleshooting explanation →

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

Trap 1: Check IAM permissions for the VM's service account

IAM permissions control API access, not network traffic; firewall rules are independent.

Trap 2: Inspect the route tables for the subnet

Routes determine packet forwarding, not firewall filtering; blocking is due to firewall rules.

Study all Troubleshooting common traps →

A
Check IAM permissions for the VM's service account
Why wrong: IAM permissions control API access, not network traffic; firewall rules are independent.
B
Check firewall rule logs in Cloud Logging
Firewall logs show allowed and denied connections, directly indicating blocking.
C
Verify that the network tags on instances match the target tags in the firewall rule
Firewall rules apply based on tags; mismatched tags cause traffic to be blocked.
D
Review VPC flow logs to see if traffic is reaching the VM
VPC flow logs show traffic metadata; if packets are dropped by firewall, flow logs may not show them.
E
Inspect the route tables for the subnet
Why wrong: Routes determine packet forwarding, not firewall filtering; blocking is due to firewall rules.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Troubleshooting sessions

Start a Troubleshooting only practice session

Every question in these sessions is drawn from the Troubleshooting domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Troubleshooting questions →Mixed PCSE session

Frequently asked questions

What does the PCSE exam test about Troubleshooting?: Troubleshooting questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Troubleshooting questions in a focused session?: Yes — the session launcher on this page draws every question from the Troubleshooting domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCSE topics?: Use the topic links above to move to related areas, or go back to the PCSE question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCSE exam covers. They are not copied from any real exam or dump site.

Troubleshooting only

10 questions 20 questions 30 questions 50 questions

Mixed PCSE session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCSE questions Troubleshooting domain overview PCSE exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Troubleshooting practice questions

What to know about Troubleshooting

Common Troubleshooting exam traps

Troubleshooting questions

Refer to the exhibit. A security administrator is troubleshooting why a user cannot access a BigQuery dataset. The user analyst@example.com is not a member of data-team@example.com. The user is trying to query a table in the dataset. What is the most likely reason for the denial?

Exhibit

A security engineer is troubleshooting a VPC firewall rule that is not allowing traffic from a specific subnet to a Compute Engine instance. The target tag is set correctly. What is the most likely cause?

Which THREE steps are most effective for troubleshooting a VPC firewall rule issue where desired traffic is being blocked?

Track your progress over time

Start a Troubleshooting only practice session

Related PCSE topic practice pages

Configuring network security practice questions

Configuring access within a cloud solution environment practice questions

Ensuring data protection practice questions

Managing operations in a cloud solution environment practice questions

Supporting compliance requirements practice questions

PCSE fundamentals practice questions

PCSE scenario practice questions

PCSE troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid