Google ACE Deploying and Implementing a Cloud Solution Practice Question
A developer is deploying a containerized application on Cloud Run. The application needs to be invoked by external HTTPS requests without requiring authentication. Which flag should be included in the 'gcloud run deploy' command?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
--allow-unauthenticated
The --allow-unauthenticated flag makes the Cloud Run service publicly accessible. By default, Cloud Run requires authentication via IAM. Adding this flag grants the 'run.invoker' role to allUsers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
--invoker=public
Why it's wrong here
This flag is not recognized by the `gcloud run deploy` command; the CLI would return a syntax error. Although Cloud Run uses IAM roles such as `roles/run.invoker`, the deployment flag for allowing public access is `--allow-unauthenticated`, not `--invoker`. Thus, this option is incorrect because it is not a valid automation command.
- ✓
--allow-unauthenticated
Why this is correct
The `--allow-unauthenticated` flag is the correct way to enable public HTTPS access to a Cloud Run service. When set at deploy time, Cloud Run binds the IAM role `roles/run.invoker` to the special `allUsers` principal, allowing any client to invoke the service without providing credentials. This directly satisfies the requirement of making the containerized app reachable from the internet.
- ✗
--ingress=internal
Why it's wrong here
The `--ingress=internal` flag restricts network traffic to requests originating from within the same VPC or Cloud Run's internal-only load balancer, effectively blocking external HTTPS requests. This setting controls the ingress path at the network layer, not authentication, so it cannot enable public access. Since the developer's goal is internet-facing availability, this option would prevent external clients from reaching the app.
- ✗
--no-allow-unauthenticated
Why it's wrong here
The `--no-allow-unauthenticated` flag is the default for Cloud Run and explicitly requires that every request be authenticated with a valid Google account or service account token. This is the exact opposite of the stated requirement, as unauthenticated clients from the public internet would receive a 401/403 error. Therefore, this flag would enforce private access instead of public exposure.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
IAM
Identity and Access Management (IAM) is a framework of policies and technologies that ensures the right individuals have the appropriate access to technology resources.
Key term
Cloud Run
Cloud Run is a fully managed compute platform from Google Cloud that lets you run containerized applications in a serverless environment, automatically scaling from zero to thousands of requests.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.