Google ACE Configuring Access and Security Practice Question
An engineer creates a firewall rule allowing ingress on port 8080 from source range 10.0.0.0/8 with priority 1000. Another rule denies ingress on port 8080 from source range 10.0.0.0/24 with priority 500. What is the effective behavior for traffic from 10.0.0.1?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Traffic is denied because the deny rule has a higher priority (lower number).
Firewall rules are evaluated in order of priority; lower numbers have higher priority. The deny rule (priority 500) has higher priority than the allow rule (priority 1000), so traffic from 10.0.0.1 (within 10.0.0.0/24) will be denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Traffic is denied only if the source is exactly 10.0.0.1; otherwise allowed.
Why it's wrong here
The deny rule is defined for the entire 10.0.0.0/24 subnet, not a single host. Any source IP within that range matches the deny condition, so traffic from 10.0.0.1 is denied, but so is traffic from any other address in the subnet. The rule does not distinguish one /32 host from the rest of the block, so this option is incorrect.
- ✓
Traffic is denied because the deny rule has a higher priority (lower number).
Why this is correct
In Google Cloud VPC firewall rules, priority values determine evaluation order; lower numbers are evaluated first. The deny rule has a priority of 500, whereas the allow rule has 1000, so the deny rule is matched first. Because GCP applies the first matching rule and then stops, the traffic is denied before the allow rule is ever considered.
- ✗
Traffic is allowed because the allow rule covers a larger range.
Why it's wrong here
Rule specificity or address range size does not control how VPC firewall rules are merged. GCP does not combine or select rules based on how broad the source or destination CIDR is; instead, it uses the numeric priority to decide which rule wins. Therefore, even though the allow rule covers a larger range, the deny rule with its lower priority number takes precedence.
- ✗
Traffic is allowed because both rules match and the default is to allow.
Why it's wrong here
The default behavior of VPC firewall rules is to deny all traffic unless a matching allow rule exists, but once explicit rules match, priority decides the outcome. In this scenario, both the allow and deny rules match the ingress packet, so GCP selects the rule with the highest priority, which is the deny rule. The statement incorrectly assumes a default 'allow' and incorrectly ignores rule priority.
Go deeper
Related to this question
Learn chapter
Cloud Storage Classes and Lifecycle Rules
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
Key term
Ingress
Ingress is a Kubernetes API object that manages external access to services within a cluster, typically via HTTP or HTTPS routing rules.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.