Google ACE Configuring Access and Security Practice Question
An engineer needs to create a firewall rule that allows incoming HTTPS traffic only from a specific IP range to instances tagged 'web-server'. Which command should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 192.168.0.0/16 --target-tags web-server
The correct command creates a firewall rule allowing TCP port 443 from the specified source range to instances with the target tag 'web-server'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 192.168.0.0/16 --target-tags web-server
Why this is correct
This rule is correct because it explicitly restricts inbound HTTPS (TCP port 443) to source IPs within the RFC 1918 private range 192.168.0.0/16 and applies only to VM instances bearing the network tag 'web-server'. The combination of --source-ranges with a CIDR and --target-tags ensures the rule targets exactly the intended web servers and only allows traffic from the specified internal subnet, satisfying the requirement.
- ✗
gcloud compute firewall-rules create allow-https --allow tcp:443 --source-tags web-server
Why it's wrong here
The --source-tags flag does not restrict traffic by IP address; instead, it matches traffic from VM instances that carry a particular network tag on their source side. This rule also lacks a --target-tags filter, so it will apply to all instances in the VPC, and it never enforces the 192.168.0.0/16 CIDR restriction. To meet the requirement, you must use --source-ranges for the IP range and --target-tags web-server to limit the scope to the web servers.
- ✗
gcloud compute firewall-rules create allow-https --allow udp:443 --source-ranges 192.168.0.0/16 --target-tags web-server
Why it's wrong here
This rule is wrong because it uses UDP as the protocol for HTTPS; HTTPS runs over TCP, and port 443 requires the reliable, connection-oriented transport provided by TCP. While the source range and target tags are correct, specifying udp:443 would not match the actual HTTPS traffic, which uses TCP segments for the TLS handshake and data transfer. Therefore, the traffic would not be permitted by this rule.
- ✗
gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 0.0.0.0/0 --target-tags web-server
Why it's wrong here
This rule incorrectly uses 0.0.0.0/0 as the source range, which allows traffic from any IPv4 address on the internet, not just the intended internal 192.168.0.0/16 subnet. Although the protocol and target tags are correct, the overly broad source range creates a security exposure by exposing the web servers to all external IPs, which violates the requirement to limit access to the specified private range. The source range must be changed to 192.168.0.0/16.
Go deeper
Related to this question
Learn chapter
Packet Mirroring and Traffic Analysis
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Firewall rule
A firewall rule is a set of conditions that tells a firewall which network traffic to allow or block based on attributes like source, destination, port, and protocol.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.