Google Professional Cloud Network Engineer Question 753
Select 3Google Cloud PlatformYou are a Google Cloud Network Engineer troubleshooting a connectivity issue between two Compute Engine instances within the same VPC network but in different subnets. Instance A cannot reach Instance B, even though both instances have the necessary IAM permissions. To diagnose the issue, you enable VPC Flow Logs, Firewall Logs, and Packet Mirroring. What steps would you take to identify the root cause of the connectivity issue?
- A
Review VPC Flow Logs to verify whether traffic is being dropped at the network level.
- B
Use Firewall Logs to confirm if an ingress or egress firewall rule is blocking the traffic.
- C
Enable Packet Mirroring on both Compute Engine instances to capture and analyze the packets being sent and received.
- D
Check the IAM permissions assigned to both instances to ensure they have the necessary roles for connectivity.
- E
Inspect the subnet configurations to confirm that both instances are in the same subnet.
Show answer and explanation
Correct answers: A, B, C
Explanation
To troubleshoot connectivity issues between two Compute Engine instances, you should start by examining VPC Flow Logs to determine if packets are being dropped at the network level. Next, use Firewall Logs to check for any blocking firewall rules. If the issue persists and requires deeper inspection, enable Packet Mirroring to analyze network traffic at the packet level. IAM permissions and subnet configurations are not relevant in this scenario because the problem is explicitly stated as a connectivity issue unrelated to IAM or subnet misconfiguration.
- A. Correct.
VPC Flow Logs provide detailed information about the traffic flowing through your VPC, including whether packets are being dropped. This is essential for diagnosing connectivity issues.
- B. Correct.
Firewall Logs allow you to determine if any firewall rules are blocking traffic. This is a common cause of connectivity issues in GCP.
- C. Correct.
Packet Mirroring can be used to capture and analyze network traffic at a packet level, which is helpful for identifying issues like misconfigured applications or unexpected packet drops.
- D. Incorrect.
IAM permissions are not relevant in this scenario as the connectivity issue is between two instances, and you already confirmed that IAM permissions are correct.
- E. Incorrect.
Subnet configurations are not relevant here because the question specifies that the two instances are in different subnets, which is expected and does not indicate a misconfiguration.