How to Troubleshoot Intermittent TCP Failures Over Public Internet in GCP?

PCNE By islever Editorial Last updated Aug 29, 2026

Short answer

B Enable and review Cloud Logging on your Cloud NAT gateway. Look for logs with errors matching the destination IP address of the public SaaS provider.

Question

You are troubleshooting connectivity issues between Google Cloud and a public SaaS provider. Connectivity between the two environments is through the public internet. Your users are reporting intermittent connection errors when using TCP to connect; however, ICMP tests show no failures. According to users, errors occur around the same time every day. You want to troubleshoot and gather information by using Google Cloud tools that are most likely to provide insights to what is occurring within Google Cloud. What should you do?

Enable and review Cloud Logging for Cloud Armor. Look for logs with errors matching the destination IP address of the public SaaS provider.
Enable and review Cloud Logging on your Cloud NAT gateway. Look for logs with errors matching the destination IP address of the public SaaS provider. Correct Answer
Enable the Firewall Insights API. Set the deny rule insights observation period to one day. Review the insights to assure there are no firewall rules denying traffic.
Create a Connectivity Test by using TCP, the source IP address of your test VM, and the destination IP address of the public SaaS provider. Review the live data plane analysis and take the next steps based on the test results.

Key Takeaways

It tests NAT port exhaustion diagnosis versus standard connectivity testing, trapping candidates who overlook that ICMP success masks underlying TCP session limits.

This question tests troubleshooting intermittent TCP failures while ICMP succeeds in Google Cloud environments. The community consensus points to enabling Cloud NAT logging to identify ephemeral port exhaustion during peak traffic periods.

Common mistake: Option D is frequently chosen because the Connectivity Test tool seems ideal for simulating TCP connections, but it only validates routing and policies at a single point in time rather than revealing sustained NAT resource exhaustion.

Expert Analysis

Why the Answer Is Correct

Enabling Cloud NAT gateway logging directly addresses the symptom pattern of intermittent TCP failures paired with successful ICMP tests. When users experience errors at consistent daily intervals, it strongly indicates a recurring traffic spike that exhausts the ephemeral port pool on the NAT gateway. Cloud NAT logs will capture dropped TCP sessions due to port allocation failures, providing actionable data confined to Google Cloud infrastructure. This aligns perfectly with the requirement to use native GCP tools for internal insight gathering.

Why the Other Options Are Wrong

Option A focuses on Cloud Armor, which handles WAF/DDoS protection and does not log routine TCP port exhaustion events. Option C uses Firewall Insights API, but since ICMP succeeds, firewall rules are clearly permitting the traffic, making deny-rule analysis irrelevant. Option D offers a Connectivity Test, which is excellent for validating static routes and security policies but cannot simulate or diagnose sustained load conditions like NAT port depletion.

Community Comment Notes

Candidates correctly identified that the daily recurrence hints at a predictable traffic surge overwhelming NAT resources. As noted in the top-voted comment, changing to option B acknowledges that connectivity tests do not effectively simulate sustained traffic loads. Another insightful remark highlights that intermittent TCP failures with working ICMP are classic indicators of NAT exhaustion, making gateway logs the definitive diagnostic step.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When troubleshooting network issues in GCP exams, always correlate protocol behavior (TCP vs. ICMP) with infrastructure limits like NAT port ranges. Prioritize logging and monitoring tools over synthetic connectivity tests when symptoms suggest resource exhaustion or performance degradation under load.

Community Votes

75%

25%

75% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

1f01b87 👍 2 Answered B

Changing my answer to B. Question states that errors occur “around the same time every day,” hinting at a daily traffic surge. Connectivity tests is for testing routing paths and policies but don't effectively simulate sustained traffic load. Intermittent TCP Failures Often Point to NAT issue due to ephemeral port exhaustion.
mohitms1996 👍 1 Answered B

Enable and review Cloud Logging on Cloud NAT gateway ✅ Best Choice Since ICMP works but TCP fails, NAT exhaustion is a strong possibility (NAT TCP ports might be depleting). Cloud NAT logging can reveal dropped connections due to port exhaustion. Recurring errors at the same time each day could indicate a peak usage period exhausting NAT resources.
1f01b87 👍 1 Answered D

I think D is a better option here since it can help to identify whether it's a NAT related issues or caused by something else in the path. Next best option is B.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide