Google ACE Configuring Access and Security Practice Question
A company has multiple firewall rules. Rule A (priority 1000) allows TCP 80 from 0.0.0.0/0. Rule B (priority 500) denies TCP 80 from 10.0.0.0/8. An instance with IP 10.0.0.1 tries to connect to TCP 80. What happens?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic is denied because Rule B has higher priority.
Firewall rules are evaluated in order of priority (lower number = higher priority). Rule B with priority 500 will be evaluated first and denies the traffic, so Rule A is not applied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The result depends on the order of creation.
Why it's wrong here
Order of creation is irrelevant to firewall rule evaluation in GCP. Rules are evaluated strictly by their priority number, where a lower number means higher priority. Because Rule B has priority 500, it is always evaluated before Rule A at priority 1000, regardless of which rule was created first. Therefore, the deny action in Rule B deterministically takes precedence.
- ✗
Traffic is allowed because Rule A allows all sources.
Why it's wrong here
While Rule A does allow all sources, its priority is 1000, which is lower than Rule B's priority of 500. GCP firewall rules are matched in ascending priority order, so Rule B is evaluated first and its deny action applies to the traffic. Rule A is never reached for this packet, so the source-based allow condition is irrelevant here.
- ✗
Both rules are applied and traffic is allowed.
Why it's wrong here
Both rules are not independently applied; instead, GCP selects a single matching rule with the highest priority to determine the action. Rule B matches first because its priority 500 is numerically lower than Rule A's 1000, and it denies the traffic. Even if both were somehow considered, a lower-priority allow rule cannot override a higher-priority deny.
- ✓
Traffic is denied because Rule B has higher priority.
Why this is correct
Rule B has a priority of 500, which is numerically lower than Rule A's priority of 1000, so GCP evaluates Rule B first. Because Rule B's action is to deny and the traffic matches its conditions, that denial is the final decision. Rule A is not evaluated, so the traffic is denied as expected.
Go deeper
Related to this question
Learn chapter
Cloud Storage Classes and Lifecycle Rules
Key term
TCP
TCP (Transmission Control Protocol) is a core internet protocol that ensures data is sent reliably and in order between devices over a network.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.