Google ACE Deploying and Implementing a Cloud Solution Practice Question
A developer needs to deploy a new version of a Cloud Run service that uses a custom container image stored in Artifact Registry. The service must be accessible only from within the same Google Cloud project and must not be reachable from the public internet. The developer wants to use the gcloud CLI to deploy. Which command should the developer use?
⚠ Common exam trap
Test-takers frequently confuse ingress control with authentication: setting --ingress=internal blocks public internet traffic but does not by itself require authentication, so --allow-unauthenticated must be replaced with --no-allow-unauthenticated to fully secure the service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
gcloud run deploy SERVICE --image=LOCATION-docker.pkg.dev/PROJECT/REPO/IMAGE:TAG --ingress=internal --no-allow-unauthenticated
To make a Cloud Run service internal-only and require authentication, combine --ingress=internal with --no-allow-unauthenticated. The internal ingress setting ensures that only traffic from within the project or VPC network can reach the service, while disabling unauthenticated access enforces identity-based access control. This is the standard pattern for private microservices that should not be exposed to the public internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
gcloud run deploy SERVICE --image=LOCATION-docker.pkg.dev/PROJECT/REPO/IMAGE:TAG --ingress=internal --allow-unauthenticated
Why it's wrong here
Using --ingress=internal correctly restricts traffic to internal sources, but --allow-unauthenticated permits unauthenticated access from those internal sources. While the service would not be reachable from the public internet, it would still be accessible without authentication to any resource within the project or VPC. The requirement implies that access should be controlled, so authentication should be required.
- ✗
gcloud run deploy SERVICE --image=LOCATION-docker.pkg.dev/PROJECT/REPO/IMAGE:TAG --ingress=all --allow-unauthenticated
Why it's wrong here
--ingress=all allows traffic from the public internet, and --allow-unauthenticated permits unauthenticated access. This would make the service publicly reachable, directly violating the requirement. Even with authentication, ingress=all exposes the service endpoint to the internet, which is not desired. This command is suitable for public APIs but not for internal-only services.
- ✓
gcloud run deploy SERVICE --image=LOCATION-docker.pkg.dev/PROJECT/REPO/IMAGE:TAG --ingress=internal --no-allow-unauthenticated
Why this is correct
The --ingress=internal flag restricts traffic to sources within the same project or VPC network, preventing public internet access. The --no-allow-unauthenticated flag requires authentication for all requests, ensuring the service is not publicly accessible. Deploying with the Artifact Registry image path is correct. This combination meets the requirement of internal-only access with authentication.
- ✗
gcloud run deploy SERVICE --image=LOCATION-docker.pkg.dev/PROJECT/REPO/IMAGE:TAG --ingress=internal-and-cloud-load-balancing --allow-unauthenticated
Why it's wrong here
--ingress=internal-and-cloud-load-balancing allows traffic from internal sources and from Cloud Load Balancing, but --allow-unauthenticated still permits unauthenticated requests from those sources. The requirement is that the service must not be reachable from the public internet and should be restricted to the project; allowing unauthenticated access could permit any internal user to invoke it without credentials. This does not enforce authentication.
Go deeper
Related to this question
Learn chapter
Shared VPC for Multi-Project Networking
Key term
Cloud Run
Cloud Run is a fully managed compute platform from Google Cloud that lets you run containerized applications in a serverless environment, automatically scaling from zero to thousands of requests.
Key term
Container
A container is a lightweight, standalone software package that includes everything needed to run an application, such as code, runtime, system tools, and libraries.
About these practice questions
Courseiva writes every ACE question from scratch — 775 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.