How to troubleshoot low-volume packet loss in GCP networks?
You are troubleshooting an application in your organization's Google Cloud network that is not functioning as expected. You suspect that packets are getting lost somewhere. The application sends packets intermittently at a low volume from a Compute Engine VM to a destination on your on-premises network through a pair of Cloud Interconnect VLAN attachments. You validated that the Cloud Next Generation Firewall (Cloud NGFW) rules do not have any deny statements blocking egress traffic, and you do not have any explicit allow rules. Following Google-recommended practices, you need to analyze the flow to see if packets are being sent correctly out of the VM to isolate the issue. What should you do?
Community Votes
75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Tests troubleshooting methodology for low-volume traffic, with the common trap being the assumption that VPC Flow Logs with a 1.0 sample rate guarantees complete packet capture.
This question evaluates the optimal method for capturing and analyzing intermittent, low-volume network traffic in Google Cloud. Community consensus strongly favors packet mirroring over VPC Flow Logs to guarantee complete visibility and isolate connectivity issues.
Option B is frequently selected due to its simplicity, but VPC Flow Logs rely on aggregation and sampling mechanisms that can still drop rare or bursty packets, making them unreliable for precise low-volume troubleshooting.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Packet mirroring duplicates all traffic from the source VM to a dedicated collector appliance, guaranteeing complete visibility regardless of volume or frequency. It bypasses sampling limitations inherent in log-based solutions and aligns with Google’s recommendation for deep packet inspection when exact packet-level analysis is required. This approach directly isolates whether egress packets leave the VM correctly before hitting potential network boundaries.Why the Other Options Are Wrong
VPC Flow Logs aggregate metadata and apply sampling even at 1.0, which can miss intermittent flows entirely. The Cloud Interconnect metric only shows dropped packets at the attachment layer, not end-to-end VM egress behavior. Firewall logging is unnecessary here since NGFW rules lack deny statements and adding it creates overhead without verifying actual transmission.Community Comment Notes
Candidates frequently debate Options A and B, but experienced test-takers note that VPC Flow Logs inherently sample flows despite the 1.0 setting, potentially dropping rare data. Comment [3] correctly emphasizes that packet mirroring ensures every single packet is captured, making it the superior choice for this scenario. Multiple users reference Google’s official documentation on flow log sampling limits to justify selecting mirroring over logging.Official Reference
Exam Strategy
Always match the troubleshooting tool to the traffic profile; use packet mirroring for low-volume or high-fidelity packet analysis, and reserve VPC Flow Logs for broader traffic pattern monitoring. Carefully scan for keywords like "intermittent," "low volume," and "isolate the issue," as they signal a need for complete packet capture rather than aggregated logs.
Related Analysis
Practice All PCNE Questions
Access 80 questions with complete answers and detailed explanations.
View Full PCNE Practice Test →