Dataflow worker VMs cannot communicate. Your network team uses Google Cloud network tags for firewall rules. To follow Google-recommended networking security practices, what should you check?

The correct answer is to check whether a firewall rule allows TCP ports 12345–12346 for the Dataflow network tag. Dataflow worker VMs communicate with each other using these specific TCP ports. Google-recommended networking security practices often involve using network tags to apply firewall rules to groups of instances, including Dataflow workers. If these ports are blocked by a firewall rule associated with the Dataflow network tag, worker VMs cannot communicate, leading to job failures. Checking for a custom VPC network tag is less direct because Dataflow automatically assigns a default tag unless specified, and the issue is likely with the rule itself, not the tag's existence. Checking the worker subnet is too broad; firewall rules are typically applied to instances via tags, not directly to subnets for inter-instance communication within the same subnet. Checking for external IP addresses is irrelevant to internal worker-to-worker communication.