Diagnosing VPC Connectivity with Network Intelligence Center
Short answer
D Use Network Intelligence Center’s Connectivity Tests to perform a reachability analysis between an instance in app-dev-spoke-vpc and the database service in db-dev-spoke-vpc.
Question
Key Takeaways
The trap is confusing Firewall Insights (a monitoring dashboard) with Connectivity Tests (an active diagnostic tool). Always use Connectivity Tests for specific reachability troubleshooting.
Learn how to diagnose VPC connectivity issues using Google Cloud's Network Intelligence Center Connectivity Tests for efficient root cause analysis.
Common mistake: Choosing Firewall Insights because it sounds like a 'firewall' problem. However, Firewall Insights is for policy visibility, while Connectivity Tests actively diagnose the path and reason for failure.
Expert Analysis
The question requires diagnosing connectivity failure between two specific VPCs using an observability tool to find the root cause. The key constraint is selecting the correct diagnostic method within Google Cloud's ecosystem.
Option D is correct because Network Intelligence Center (NIC) provides Connectivity Tests, which are purpose-built observability tools designed to perform reachability analysis. These tests simulate traffic flow and provide a detailed explanation of why connectivity succeeds or fails, directly addressing the need to determine the root cause efficiently.
Option A (Firewall Insights) is incorrect for this specific task. While it analyzes firewall rule configuration, it is a monitoring dashboard rather than a direct diagnostic test for specific instance-to-instance reachability. It helps identify misconfigured rules at scale but does not provide the immediate, targeted reachability analysis requested.
Option B is incorrect as it suggests manual inspection. This is inefficient and prone to error compared to using automated observability tools. The prompt specifically asks to use an observability tool.
Option C is incorrect because internal communication between VPCs in a hub-and-spoke topology via Network Connectivity Center typically uses private IP addresses over the backbone network. External IP addresses are not required for spoke-to-spoke communication through the NCC hub, and verifying external IPs would not diagnose the actual connectivity path issue.
Exam Strategy
When a question asks to 'diagnose' or 'determine root cause' for specific resources, look for active testing tools like Connectivity Tests or Packet Mirroring. Avoid passive monitoring dashboards (like Firewall Insights) unless the question asks for broad policy visibility or trend analysis.
Frequently Asked Questions
What is the difference between Firewall Insights and Connectivity Tests?
Do VPCs connected via Network Connectivity Center need external IPs?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Martrin 👍 1 Answered DThe correct answer is D. The question asks you yo use observability tools of GCP. That leaves options a and d. Option D is better because if will give you the root cause of the problem if it is not related to FW rules
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All PCNE Questions
Access 80 questions with complete answers and detailed explanations.
View Full PCNE Practice Test →