Google ACE Configuring Access and Security Practice Question
An engineer needs to enable Private Google Access for a subnet to allow instances without external IPs to access Google APIs and services. Which flag should be used when creating or updating the subnet?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
--enable-private-ip-google-access
Private Google Access is enabled on a subnet using the `--enable-private-ip-google-access` flag. This allows instances in the subnet to reach Google APIs via the default route.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
--enable-google-access
Why it's wrong here
This flag is not a valid gcloud compute networks subnets update command flag. Google Cloud uses the explicit "private-ip-google-access" terminology, and "enable-google-access" is ambiguous and not recognized by the CLI reference. Attempting to use it will result in an unknown flag error, so it cannot configure Private Google Access.
- ✗
--private-google-access
Why it's wrong here
This flag omits the "enable" and "ip" components that appear in the actual gcloud flag. The correct flag is "--enable-private-ip-google-access"; without "enable" and "ip", gcloud does not recognize the flag. The flag name must exactly match the API field "privateIpGoogleAccess" and the CLI's explicit naming convention.
- ✓
--enable-private-ip-google-access
Why this is correct
This is the correct flag. According to the gcloud compute networks subnets update documentation, "--enable-private-ip-google-access" modifies the subnet's privateIpGoogleAccess field, allowing VM instances without external IP addresses to reach Google APIs using the subnet's default route. This is the only flag listed that maps directly to the REST API parameter.
- ✗
--enable-private-ip
Why it's wrong here
This flag is not a valid gcloud command flag; it is an incomplete name that omits the "google-access" suffix. The full flag is "--enable-private-ip-google-access", and a truncated version will be rejected by gcloud as an unknown flag.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Default route
A default route is a catch-all routing entry that tells a network device where to send packets when no specific route matches the destination address.
Key term
Private Google Access
Private Google Access lets virtual machines in a Google Cloud VPC reach Google APIs and services using private IP addresses, without needing public internet access.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.