Google ACE Practice Question: Ensuring Successful Operation of a Cloud Solution

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a Cloud Monitoring alert for packet loss

  Why it's wrong here

  Creating a Cloud Monitoring alert for packet loss is reactive and does not identify the root cause. Packet loss metrics may not be visible if the network path is silently dropping traffic due to VPC firewall rules, and an alert only notifies you after the fact. The correct diagnostic step is to inspect firewall rule logs or the rules themselves to see whether traffic is being denied.

• ✓

  View Cloud Logging for firewall rule logs

  Why this is correct

  Viewing Cloud Logging for firewall rule logs is the direct way to see whether VPC firewall rules are dropping or allowing traffic. Firewall rule logging records each connection attempt with details like source IP, destination IP, port, protocol, and the action (allow or deny). If the Compute Engine instance is unreachable due to a firewall rule, these logs will show the denied packets, making this a reliable troubleshooting step.

• ✗

  Run gcloud compute ssh --dry-run

  Why it's wrong here

  Running `gcloud compute ssh --dry-run` only prints the SSH command and its arguments without actually attempting a connection. It does not test network connectivity, firewall rules, or IAM permissions, so it cannot reveal why the instance is unreachable. While it can help verify local SSH configuration, it is useless for diagnosing VPC firewall issues.

• ✗

  Use Cloud Trace to analyze network latency

  Why it's wrong here

  Cloud Trace is designed for analyzing application-level request latency in distributed systems, not for diagnosing network connectivity or firewall rule problems. It requires instrumentation in the application and does not capture packet-level events or VPC firewall decisions. Therefore, using Cloud Trace to analyze network latency would not show whether a firewall rule is blocking traffic to the Compute Engine instance.

• ✓

  Check VPC firewall rules in Cloud Console

  Why this is correct

  Checking VPC firewall rules in Cloud Console lets you review ingress and egress rules, their priorities, targets, and allowed/denied protocols. This is essential because firewall rules are evaluated in priority order, with an implied deny rule at the lowest priority, so a misconfigured rule could block SSH or other traffic. By inspecting these rules, you can quickly spot missing or overly restrictive rules that would prevent connectivity to the instance.

Go deeper

Related to this question