Google ACE Deploying and Implementing a Cloud Solution Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Grant the user the roles/iap.tunnelResourceAccessor IAM role on the instance

  Why this is correct

  Granting the roles/iap.tunnelResourceAccessor IAM role on the instance is the core authorization required for IAP TCP tunneling. This role ties a Google-authenticated user identity to a specific instance, letting them establish an encrypted tunnel through Cloud IAP to reach SSH or RDP even when the VM has only an internal IP. Without this IAM binding, the user cannot invoke `gcloud compute start-iap-tunnel` or the IAP API, making it the fundamental step for identity-aware access.

• ✗

  Set a firewall rule allowing ingress from the IP 203.0.113.5 to port 22

  Why it's wrong here

  A firewall rule allowing ingress from 203.0.113.5 to port 22 is misguided because the instance has only an internal IP address, so the external client cannot route directly to it. In IAP tunneling, the TCP connection originates not from the client's IP but from IAP's proxy service, specifically from the 35.235.240.0/20 address range; therefore the source in the rule would never match the actual traffic. The correct firewall practice is to permit ingress from IAP's proxy ranges to port 22 on the instance, not from the user's public IP.

• ✗

  Modify the Cloud NAT to allow the external IP

  Why it's wrong here

  Cloud NAT translates outbound traffic from internal instances to the internet, but it does not accept inbound connections from an external IP; it lacks a mechanism to forward unsolicited inbound traffic to a specific internal instance. This option is tempting because Cloud NAT is often used to grant external access for outbound traffic, and one might assume it can be reversed for inbound access, but it would only be correct if the requirement were to allow the instance to reach the internet, not to allow an external IP to reach the instance.

• ✗

  Assign a public IP to the instance

  Why it's wrong here

  Assigning a public IP would violate the explicit requirement that the instance have only an internal IP, and it would expose the VM to the open internet, expanding its attack surface unnecessarily. Even with a public IP, you would need a separate firewall rule allowing SSH from 203.0.113.5, thereby abandoning IAP's identity-based access controls and audit logging. IAP tunneling is precisely the mechanism that avoids public IP exposure while still granting secure, user-specific access.

• ✓

  Use 'gcloud compute start-iap-tunnel' to create a tunnel to the instance

  Why this is correct

  Running `gcloud compute start-iap-tunnel` is the operational step that creates an encrypted, authenticated TCP tunnel via Cloud IAP to the instance's SSH port (usually 22). This command forwards a local port on the client machine to the instance over the IAP control plane, allowing the engineer to SSH to `localhost` without any public IP on the VM. It is only successful if the caller holds the roles/iap.tunnelResourceAccessor role, making it a complementary action to the IAM grant rather than a standalone alternative.

Go deeper

Related to this question