Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a rule with source tag 'subnet-a-instances', allow tcp:443, and target tag 'https-server'.

  Why it's wrong here

  This rule cannot be created because VPC firewall rules only accept IPv4/IPv6 CIDR ranges as the source, not network tags or instance tags. Source tags are simply not a supported field in the firewall rule grammar, so the configuration is invalid from the start. Even if tags were allowed, they do not translate to the IP addresses of instances in subnet-a, so the intended source restriction would not be enforceable.

• ✗

  Create a rule with source range 0.0.0.0/0, allow tcp:443, and target the specific instance.

  Why it's wrong here

  Setting the source range to 0.0.0.0/0 allows inbound TCP 443 traffic from any IP address on the internet, not just from subnet-a's 10.0.1.0/24 range. This directly violates the requirement to restrict access solely to the instances in subnet-a, creating an unnecessarily broad exposure. While targeting the specific instance limits the destination, the source is far too permissive, so the rule does not meet the stated security constraint.

• ✗

  Create a rule with source range 10.0.1.0/24, allow tcp:443, and apply to all instances in subnet-b.

  Why it's wrong here

  This rule correctly specifies the source as 10.0.1.0/24, but by applying it to all instances in subnet-b (e.g., via a broad target tag or no target tag), it permits any instance in subnet-b to receive HTTPS traffic on port 443. The requirement is to allow traffic only to the one specific web server instance, so this rule over-permits and expands the blast radius beyond what was asked for. A more precise target, such as a unique network tag applied only to that instance, is needed.

• ✓

  Create a rule with source range 10.0.1.0/24, allow tcp:443, and target tag 'https-server' applied to the specific instance.

  Why this is correct

  This rule is correct because it pairs a source range of 10.0.1.0/24—exactly matching subnet-a—with a target tag, such as 'https-server', that is applied only to the specific instance in subnet-b. The VPC firewall rule then evaluates the source IP of the incoming packet against the allowed CIDR and the destination instance's effective firewall tags to determine whether to permit TCP 443. Since both conditions are tightly scoped, the rule enforces the intended access: only instances in subnet-a can reach that one HTTPS server, and all other traffic is implicitly denied.

Go deeper

Related to this question