Google ACE Practice Question: A team wants to allow inbound HTTPS traffic (TCP…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  An ingress allow rule for port 443 from 0.0.0.0/0 targeting the 'web-server' tag, relying on the implied deny for other traffic

  Why this is correct

  VPC firewall rules are stateful and evaluated in priority order, with an implicit deny-all ingress rule at priority 65535 that blocks any inbound traffic not explicitly allowed. An allow rule for tcp:443 from 0.0.0.0/0 targeting the 'web-server' tag explicitly permits HTTPS while all other ports remain implicitly denied, so no explicit deny rule is necessary. This single rule is sufficient because GCP's firewall model defaults to deny when no match exists.

• ✗

  An ingress allow rule for port 443 and a separate egress deny rule for all other ports

  Why it's wrong here

  Egress firewall rules govern traffic leaving the instance (outbound), so an egress deny-all rule cannot affect inbound HTTPS connection attempts from the internet; those are governed only by ingress rules. Moreover, an all-ports egress deny rule would block the instance from initiating new outbound connections, such as DNS queries, OS updates, or connecting to external APIs. While stateful firewall behavior automatically allows return packets for already-approved 443 connections, all other outbound traffic is broken, and the rule still does nothing to protect the inbound 443 port.

• ✗

  An ingress deny rule for all ports from 0.0.0.0/0, plus an ingress allow for port 443 with lower priority

  Why it's wrong here

  In GCP, firewall rules are evaluated from lowest priority number to highest, and the first rule that matches a packet is applied. An ingress deny-all rule with a lower numeric priority (e.g., priority 100) would match every incoming packet before the allow rule with a higher numeric priority (e.g., priority 200) is considered, so all traffic—including HTTPS on port 443—would be blocked. Explicit deny rules are unnecessary because the implied deny-all already handles unpermitted traffic; adding a higher-priority deny is counterproductive and would break the intended access.

• ✗

  A Cloud Armor policy allowing only HTTPS requests to port 443

  Why it's wrong here

  Cloud Armor policies evaluate traffic at the HTTP(S) load balancer edge, not at the VPC network layer that governs instance interfaces. A Cloud Armor policy can restrict by protocol (HTTPS) but does not block or allow traffic to a specific port on a VM; only VPC firewall rules control port reachability. Furthermore, Cloud Armor is an L7 security feature, so it cannot enforce TCP-level allow/deny on arbitrary instance ports. Thus, it is ineffective for this L4 port-based requirement.

Go deeper

Related to this question