Google
PROFESSIONAL-CLOUD-NETWORK-ENGINEER · Question #6
You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see…
The correct answer is C. The traffic is not matching the expected ingress rule. Ingress packets are sampled after ingress firewall rules. If an ingress firewall rule denies inbound packets, those packets are not sampled by VPC Flow Logs. https://cloud.google.com/vpc/docs/flow-logs
Submitted by wei.xz· Apr 18, 2026Implementing network security
Question
You have an application hosted on a Compute Engine virtual machine instance that cannot communicate with a resource outside of its subnet. When you review the flow and firewall logs, you do not see any denied traffic listed. During troubleshooting you find: - Flow logs are enabled for the VPC subnet, and all firewall rules are set to log. - The subnetwork logs are not excluded from Stackdriver. - The instance that is hosting the application can communicate outside the subnet. - Other instances within the subnet can communicate outside the subnet. - The external resource initiates communication. What is the most likely cause of the missing log lines?
Options
- AThe traffic is matching the expected ingress rule.
- BThe traffic is matching the expected egress rule.
- CThe traffic is not matching the expected ingress rule.
- DThe traffic is not matching the expected egress rule.
How the community answered
(43 responses)- A19% (8)
- B5% (2)
- C67% (29)
- D9% (4)
Explanation
Ingress packets are sampled after ingress firewall rules. If an ingress firewall rule denies inbound packets, those packets are not sampled by VPC Flow Logs. https://cloud.google.com/vpc/docs/flow-logs
Topics
#VPC Firewall Rules#Firewall Logging#Network Troubleshooting#Implicit Deny
Community Discussion
No community discussion yet for this question.