Google ACE Planning and Configuring a Cloud Solution Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use Cloud Load Balancing with an HTTPS load balancer to forward traffic to the instance

  Why this is correct

  An external HTTPS load balancer provides a managed, anycast IP that terminates SSL/TLS and forwards decrypted HTTP/HTTPS traffic to the instance over your VPC. This keeps the VM itself on an internal IP, so it is never directly exposed to the internet. The load balancer also adds health checking, autoscaling integration, and Google Cloud Armor DDoS/security policy protection.

• ✗

  Configure a VPN from the internet to the VPC

  Why it's wrong here

  A VPN connection (Cloud VPN or HA VPN) is designed for encrypted site-to-site connectivity between your peer network and your VPC, not for delivering public web traffic from arbitrary internet users. Internet clients would need their own VPN client, shared secrets, and valid credentials, which is unreasonable for normal HTTPS access to an application. Even if configured, a VPN gateway does not natively forward port 443 traffic to a single instance without additional proxy or translation infrastructure.

• ✗

  Create a Cloud NAT gateway and a firewall rule allowing ingress on port 443

  Why it's wrong here

  Cloud NAT is a purely outbound service: it maps VM-to-internet connections to a set of external IP addresses, but it never listens for or accepts inbound packets. A firewall rule allowing ingress on port 443 to the NAT gateway is ineffective because the NAT gateway has no forwarding table that can route an incoming connection to the backend VM. Without an external IP on the VM or a load balancer in front of it, any external client's request cannot reach the application.

• ✗

  Assign an external IP to the VM and create a firewall rule allowing ingress from 0.0.0.0/0 on port 443

  Why it's wrong here

  While assigning an external IP and allowing 0.0.0.0/0 on port 443 does technically make the app reachable, it exposes the VM directly to the internet with no managed SSL termination, no DDoS protection, and a public IP that must be tracked if the VM is recreated. It also bypasses the load-balancing tier, so you cannot easily scale horizontally or apply global security policies like Cloud Armor. Google best practice is to use an HTTPS load balancer in front of the instance, reserving direct external IPs only when the instance itself needs a static public endpoint.

Go deeper

Related to this question