How to Enable VPC Flow Logs for Subnet-2 in Shared VPC?

PCNE By islever Editorial Last updated

Short answer

B Configure VPC Flow Logs in the service project VPC for Subnet-2.

Question

You have the following Shared VPC design. VPC Flow Logs is configured for Subnet-1 in the host VPC. You also want to monitor flow logs for Subnet-2. What should you do? - Exhibit: How to Enable VPC Flow Logs for Subnet-2 in Shared VPC?
  1. Configure a VPC Flow Logs filter for Subnet-2 in the host project VPC.
  2. Configure VPC Flow Logs in the service project VPC for Subnet-2. Correct Answer
  3. Configure Packet Mirroring in both the host and service project VPCs.
  4. Configure a firewall rule to permit Subnet-2 IP addresses outbound in the host project VPC.

Key Takeaways

Examines the boundary between host and service project networking, testing whether candidates recognize that flow logs are scoped to individual VPCs rather than automatically aggregated across Shared VPC hierarchies.

Configuring VPC Flow Logs requires enabling logging at the specific VPC level where traffic originates. Community consensus confirms that since Subnet-2 resides in a separate service project VPC, flow logs must be explicitly configured there rather than relying on host project settings.

Common mistake: Option A is the most frequent incorrect choice, stemming from a misinterpretation of Google Cloud documentation regarding host-project log consolidation; this rule only applies when subnets are actually attached to the host VPC, not to independent service project networks.

Expert Analysis

Why the Answer Is Correct

VPC Flow Logs operate at the VPC network level, meaning each distinct VPC requires its own logging configuration. Since Subnet-2 is located in a separate service project VPC, enabling flow logs there directly captures its traffic metadata. This approach aligns with Google Cloud architecture where logging scope matches the VPC boundary, ensuring accurate monitoring for resources outside the host project.

Why the Other Options Are Wrong

Option A fails because filtering alone cannot generate logs for a VPC where logging is disabled, and cross-project filtering does not bypass the initial collection requirement. Option C introduces Packet Mirroring, which duplicates raw packets for analysis rather than collecting structured flow metadata efficiently. Option D modifies firewall rules, which controls traffic allowance but has no impact on logging collection or visibility.

Community Comment Notes

Multiple candidates highlighted that the diagram depicts two entirely separate VPCs, confirming that Subnet-2 belongs to the service project network. Commenters noted that compute instances cannot span multiple VPCs within the same project, reinforcing the architectural separation. While some cited official documentation about host-project log consolidation, others clarified that this rule strictly applies to subnets actually provisioned under the host VPC, not independent service networks.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always verify which project owns the VPC containing your target subnet before selecting logging options. Remember that VPC Flow Logs must be enabled at the network level first, as filters or mirroring are secondary configurations that cannot replace initial logging activation.

Community Votes

B
62%
A
38%

62% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. Cris0303 👍 8
    A compute engine can't have multiple NICs in the same VPC, so in the figure the VPCs are two (even if with the same name), one in the host project and one in the service project. So the answer is B
  2. PeppaPig 👍 4
    B is right Those are two separate VPCs
  3. gonlafer 👍 2 Answered A
    It's A. https://cloud.google.com/vpc/docs/flow-logs#vm-to-vm-flows-shared-vpc
  4. zzaric 👍 1
    It's B. Service project has it's own VPC where the Subnet-2 is located and it has nothing to do with Host Project and Shared VPC. If the Subnet-2 was the part of Host project Shared VPC then correct answer would be B.
  5. [Removed] 👍 1 Answered A
    "In Shared VPC networks, logs only appear in the host project, not the service projects. Make sure you look for the logs in the host project." https://cloud.google.com/vpc/docs/using-flow-logs I go with A
Show 4 more comments
  1. desertlotus1211 👍 1
    A Shared VPC network is a VPC network defined in a host project and made available as a centrally shared network for eligible resources in service projects
  2. anshad666 👍 1 Answered B
    A compute engine can't have multiple NICs in the same VPC
  3. d07d3be 👍 2 Answered B
    B is correct
  4. nkastanas 👍 1 Answered B
    agree its B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

How to Resolve BGP Session Failures on Cloud Interconnect?

S-grade

Deploying Packet Mirroring Policies in GCP Regions

S-grade

Troubleshooting Asymmetric Traffic on Google Cloud Interconnect

S-grade

How to Configure DNS Forwarding Across Isolated VPC Networks?

S-grade

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide