The answer is that VPC Flow Logs do not capture traffic to the metadata server at 169.254.169.254, which is the most likely reason for the missing logs. This exclusion exists because Google Cloud treats metadata server communication as internal infrastructure traffic, designed to support instance configuration and discovery rather than user-driven data flows, so it is intentionally omitted from flow log collection to reduce noise and avoid logging sensitive metadata. On the Google Professional Cloud Security Engineer exam, this question tests your understanding of VPC Flow Logs documented limitations, often appearing as a trap where candidates assume all subnet traffic is logged, including metadata queries. A common memory tip is to remember that the metadata IP is a link-local address (169.254.x.x) and think of it as a “silent helper” that Google keeps off the logs—if you see missing intra-subnet traffic, always check for 169.254.169.254 first.
PCSE Configuring network security Practice Question
This PCSE practice question tests your understanding of configuring network security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your organization has a security requirement that all traffic to and from Compute Engine instances must be logged and analyzed. You have enabled VPC Flow Logs for all subnets. However, you notice that flow logs are not capturing all traffic between instances in the same subnet. What is the most likely reason?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic to the metadata server (169.254.169.254) is not captured by VPC Flow Logs.
VPC Flow Logs do not capture traffic to the metadata server (169.254.169.254) because that traffic is considered internal infrastructure communication and is excluded from flow log collection by design. This is a documented limitation in Google Cloud, and it explains why some traffic between instances in the same subnet—such as metadata queries—is missing from the logs.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
VPC Flow Logs must be enabled on each individual instance, not on subnets.
Why it's wrong here
VPC Flow Logs are enabled at the subnet level and apply to all instances in that subnet.
✗
VPC Flow Logs only capture traffic that crosses subnet boundaries.
Why it's wrong here
VPC Flow Logs capture both intra-subnet and inter-subnet traffic.
✓
Traffic to the metadata server (169.254.169.254) is not captured by VPC Flow Logs.
Why this is correct
Metadata server traffic is not captured to reduce noise.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
VPC Flow Logs sample only 1 out of 10 packets by default.
Why it's wrong here
When enabled, VPC Flow Logs capture all packets; sampling is not default.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the misconception that VPC Flow Logs capture all traffic, including metadata server communication, when in fact metadata traffic is explicitly excluded from flow log collection.
Detailed technical explanation
How to think about this question
The metadata server (169.254.169.254) uses link-local addresses and is handled by the hypervisor, not by the virtual network interface that VPC Flow Logs monitor. This means any instance querying metadata (e.g., for SSH keys, service accounts, or startup scripts) generates traffic that is invisible to flow logs, which can be a blind spot in security monitoring. In a real-world scenario, an attacker exfiltrating data via metadata requests would not appear in flow logs, so additional monitoring (e.g., audit logs) is needed.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Configuring network security — This question tests Configuring network security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Traffic to the metadata server (169.254.169.254) is not captured by VPC Flow Logs. — VPC Flow Logs do not capture traffic to the metadata server (169.254.169.254) because that traffic is considered internal infrastructure communication and is excluded from flow log collection by design. This is a documented limitation in Google Cloud, and it explains why some traffic between instances in the same subnet—such as metadata queries—is missing from the logs.
What should I do if I get this PCSE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCSE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCSE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.