How to Enable VPC Flow Logs for Subnet-2 in Shared VPC?

You have the following Shared VPC design. VPC Flow Logs is configured for Subnet-1 in the host VPC. You also want to monitor flow logs for Subnet-2. What should you do? - image

  1. Configure a VPC Flow Logs filter for Subnet-2 in the host project VPC.
  2. Configure VPC Flow Logs in the service project VPC for Subnet-2. Source Reference Answer
  3. Configure Packet Mirroring in both the host and service project VPCs.
  4. Configure a firewall rule to permit Subnet-2 IP addresses outbound in the host project VPC.

Community Votes

B
62%
A
38%

62% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Examines the boundary between host and service project networking, testing whether candidates recognize that flow logs are scoped to individual VPCs rather than automatically aggregated across Shared VPC hierarchies.

Configuring VPC Flow Logs requires enabling logging at the specific VPC level where traffic originates. Community consensus confirms that since Subnet-2 resides in a separate service project VPC, flow logs must be explicitly configured there rather than relying on host project settings.

Option A is the most frequent incorrect choice, stemming from a misinterpretation of Google Cloud documentation regarding host-project log consolidation; this rule only applies when subnets are actually attached to the host VPC, not to independent service project networks.

Community Discussion (10 comments)

Cris0303 👍 8
A compute engine can't have multiple NICs in the same VPC, so in the figure the VPCs are two (even if with the same name), one in the host project and one in the service project. So the answer is B
d07d3be 👍 2 Selected: B
B is correct
832f53c 👍 1 Selected: B
B is correct
nkastanas 👍 1 Selected: B
agree its B
anshad666 👍 1 Selected: B
A compute engine can't have multiple NICs in the same VPC
desertlotus1211 👍 1
A Shared VPC network is a VPC network defined in a host project and made available as a centrally shared network for eligible resources in service projects
zzaric 👍 1
It's B. Service project has it's own VPC where the Subnet-2 is located and it has nothing to do with Host Project and Shared VPC. If the Subnet-2 was the part of Host project Shared VPC then correct answer would be B.
gonlafer 👍 2 Selected: A
It's A. https://cloud.google.com/vpc/docs/flow-logs#vm-to-vm-flows-shared-vpc
PeppaPig 👍 4
B is right Those are two separate VPCs
[Removed] 👍 1 Selected: A
"In Shared VPC networks, logs only appear in the host project, not the service projects. Make sure you look for the logs in the host project." https://cloud.google.com/vpc/docs/using-flow-logs I go with A

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

VPC Flow Logs operate at the VPC network level, meaning each distinct VPC requires its own logging configuration. Since Subnet-2 is located in a separate service project VPC, enabling flow logs there directly captures its traffic metadata. This approach aligns with Google Cloud architecture where logging scope matches the VPC boundary, ensuring accurate monitoring for resources outside the host project.

Why the Other Options Are Wrong

Option A fails because filtering alone cannot generate logs for a VPC where logging is disabled, and cross-project filtering does not bypass the initial collection requirement. Option C introduces Packet Mirroring, which duplicates raw packets for analysis rather than collecting structured flow metadata efficiently. Option D modifies firewall rules, which controls traffic allowance but has no impact on logging collection or visibility.

Community Comment Notes

Multiple candidates highlighted that the diagram depicts two entirely separate VPCs, confirming that Subnet-2 belongs to the service project network. Commenters noted that compute instances cannot span multiple VPCs within the same project, reinforcing the architectural separation. While some cited official documentation about host-project log consolidation, others clarified that this rule strictly applies to subnets actually provisioned under the host VPC, not independent service networks.

Official Reference

Exam Strategy

Always verify which project owns the VPC containing your target subnet before selecting logging options. Remember that VPC Flow Logs must be enabled at the network level first, as filters or mirroring are secondary configurations that cannot replace initial logging activation.

Related Analysis

Your frontend application VMs and your backend database VMs

A-Grade

You are a network administrator at your company planning a m

S-Grade

You configured a single IPSec Cloud VPN tunnel for your orga

A-Grade

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide