Google ACE Practice Question: A security team wants to prevent every project in…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a firewall rule in every project blocking outbound traffic on port 80 and 443

  Why it's wrong here

  Firewall rules govern the flow of traffic over the network—they do not control whether a VM is created with an external IP address. Blocking outbound traffic on ports 80 and 443 might limit some egress internet activity, but the VM could still have a public IP and accept inbound traffic on other ports, or simply be assigned the IP without any traffic flowing. Additionally, managing per-project firewall rules does not scale and leaves gaps if a new project is created without the rule, so it is neither a technical nor an operational fix for preventing external IP assignment.

• ✓

  Set the organization policy constraint compute.vmExternalIpAccess to Deny All at the organization level

  Why this is correct

  The compute.vmExternalIpAccess organization policy is a list constraint that governs whether VMs can be assigned external IP addresses. Setting it to 'Deny All' at the organization level means the policy inherits down to every project and future project, so no VM can ever get an ephemeral or static external IP. This is the correct, centralized, and scalable preventive control because it directly blocks the resource assignment at the API level, rather than reacting to traffic or permissions.

• ✗

  Remove the Compute Engine Admin role from all project owners

  Why it's wrong here

  Removing the Compute Engine Admin role from project owners is an over-broad IAM change that cripples legitimate management tasks, such as creating and deleting instances, managing disks, and updating instance metadata. It does not guarantee prevention of external IP assignment, because owners may still have other roles, or they could grant the role back if they have project owner permissions. Furthermore, this does not block existing VMs that already have external IPs, and it breaks normal project administration, making it an incorrect and counterproductive approach.

• ✗

  Use Cloud Armor to block all traffic destined for public IPs in the organization

  Why it's wrong here

  Cloud Armor is a Web Application Firewall (WAF) that inspects HTTP/HTTPS traffic at Layer 7 and applies security policies to mitigate attacks like OWASP Top 10 and volumetric DDoS. It operates on traffic destined to external IPs and does not prevent the actual assignment of an external IP to a VM—those VMs would still be publicly reachable, just with filtered traffic. The requirement is to keep VMs from having public IPs at all, which is a resource configuration issue that Cloud Armor cannot enforce.

Go deeper

Related to this question