A connectivity test you ran from Network Intelligence Center reports success, yet users still cannot reach a service. What is the most likely explanation for the discrepancy?

Connectivity Tests in Google Cloud's Network Intelligence Center primarily assess the control plane configuration, meaning they verify that your network policies, routes, and firewall rules are correctly configured to allow traffic flow. They perform a modeled reachability analysis based on this configuration. However, they do not directly interact with the data plane in real-time or inspect the internal state of virtual machines. Therefore, even if the control plane indicates connectivity, issues like a service not running on the instance, a host-based firewall blocking traffic, or transient network problems (packet loss) can still prevent actual user traffic from reaching the service. The other options are incorrect because: Connectivity Tests can be run for both external and internal connectivity, not just external. Packet Mirroring is a separate diagnostic tool and not a prerequisite for Connectivity Tests to function or be reliable. Connectivity Tests can be run on demand, not just once per day.