Google ACE Practice Question: A security team wants to restrict access to a…

A security team wants to restrict access to a Google Cloud project such that only virtual machines with a specific tag 'web' can connect to a Compute Engine instance on port 443. Which configuration is required?

⚠ Common exam trap

Google Cloud often tests the distinction between ingress and egress firewall rules, and the trap here is that candidates mistakenly choose an egress rule (Option A) because they think of restricting traffic 'from' the source, but the correct direction for controlling incoming connections to a target is ingress.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create a firewall rule allowing ingress from instances with tag 'web' to the target instance on port 443.

Firewall rules in Google Cloud are stateful and control ingress traffic at the network level. To allow only VMs with tag 'web' to connect to the target instance on port 443, you must create an ingress firewall rule that specifies the source tag 'web', the target instance (or its network tag), and the protocol/port tcp:443. This rule permits incoming HTTPS traffic from any VM that has the 'web' tag, regardless of its IP address.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Create a firewall rule allowing egress from instances with tag 'web' to the target instance on port 443.
Why it's wrong here
Egress firewall rules govern outbound traffic generated from the source instance, not inbound traffic arriving at the target. The requirement is to restrict who can reach the target instance on port 443, which is an ingress condition. An egress rule on the 'web' instances would only affect their outbound connections, leaving the target exposed to other sources, so this rule would not enforce the desired restriction.
✓
Create a firewall rule allowing ingress from instances with tag 'web' to the target instance on port 443.
Why this is correct
An ingress firewall rule applied to the target's VPC network can use source tags to restrict incoming traffic to only those instances bearing the 'web' tag. Since the rule's direction is ingress, it operates on traffic destined for the target instance on the specified port. This is the standard, supported method for tag-based network access control on Google Cloud.
✗
Set an IAM condition on the instance to only allow calls from instances with tag 'web'.
Why it's wrong here
IAM conditions govern permissions for identities and resources, but they cannot evaluate the network tag of a requesting instance. Network tags are metadata used by firewall rules, not attributes IAM conditions can inspect. Additionally, IAM does not sit in the data path for TCP/UDP traffic; it controls whether a user or service account can perform an action, not whether packets are delivered. Therefore, an IAM condition cannot enforce this network-level restriction.
✗
Use Cloud Armor to filter traffic based on tags.
Why it's wrong here
Cloud Armor is an edge security service that attaches to external HTTP(S) load balancers and provides WAF and DDoS protection. It filters traffic at the load balancer, not on individual VMs, and its match conditions do not include GCP instance network tags. Since the security team needs to restrict traffic directly to an instance, Cloud Armor would not be able to enforce this policy.

Go deeper

Google ACE Practice Question: A security team wants to restrict access to a…

Why each option matters

Option-by-option breakdown

Related to this question