Google ACE Practice Question: Prevent developers from creating Compute Engine…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a VPC firewall rule blocking all outbound internet traffic.

  Why it's wrong here

  A VPC firewall rule that blocks all outbound internet traffic operates at layer 3/4 to filter packets exiting an instance, but it does not prevent the assignment of an external IP at VM creation. The IP is allocated and attached to the network interface during the `instances.insert` operation, before any firewall rules are evaluated. Even with complete egress blocking, the VM would still have an external IP address, which is precisely the condition the organization wants to avoid.

• ✓

  Apply the `compute.vmExternalIpAccess` org policy constraint set to deny all VMs.

  Why this is correct

  The `compute.vmExternalIpAccess` organization policy constraint is a list constraint that specifically governs whether Compute Engine VMs can be provisioned with external IP addresses. When you set the `allowedValues` list to empty (`[]`), the constraint denies external IP assignment for all VMs under the folder, enforced at VM creation time by the Compute Engine API. This directly meets the requirement to allow VM creation while prohibiting public IP addresses, unlike network-level controls that only affect traffic.

• ✗

  Remove the `compute.instanceAdmin` role from developers so they cannot configure network interfaces.

  Why it's wrong here

  Revoking `compute.instanceAdmin` from developers would remove the ability to create VMs and manage network interfaces, but it also blocks VM creation altogether because that role is a prerequisite for many creation workflows. This is overly restrictive: the requirement is to permit developers to create VMs, just without external IPs. Additionally, developers might retain other roles like `compute.instanceAdmin.v1` or `compute.instances.create` that still allow VM creation, so the change is both excessive and unreliable as a control.

• ✗

  Configure the default VPC network to use internal-only routes.

  Why it's wrong here

  Configuring the default VPC to use internal-only routes alters how packets are forwarded—for example, by removing the default route via the internet gateway—but it has no effect on IP address assignment. A VM can be created with an external IP even if its routing table has only internal routes; routes are evaluated only when sending traffic, not when the instance is provisioned. The external IP remains attached to the instance, so this does not satisfy the policy requirement.

Go deeper

Related to this question