Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24 --enable-private-ip-google-access

  Why this is correct

  This command explicitly creates a subnet in a custom mode VPC (assuming the VPC already exists) and enables Private Google Access, allowing instances in that subnet to reach Google APIs and services through their internal IP addresses without needing a NAT or external IP. In a custom mode VPC, you must create each subnet manually, and this command defines the region and IP range, making it a required step after the VPC is created. Without this flag, the subnet would lack the Private Google Access capability, which is often a prerequisite for workloads that should reach Google services without public IPs.

• ✓

  gcloud compute networks create my-vpc --subnet-mode custom

  Why this is correct

  This command creates a new VPC network named my-vpc in custom subnet mode, meaning it starts with no subnets and allows you to define subnets with your own IP ranges and regions. Custom mode is the correct choice when you need full control over subnet planning, such as specific CIDR ranges or future IP space management, unlike auto mode which auto-generates subnets in every region. This is the foundational command but it alone does not create any subnets; a subsequent subnet creation command is required.

• ✗

  gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24

  Why it's wrong here

  This command is incomplete because it creates a subnet but omits the --enable-private-ip-google-access flag, leaving Private Google Access disabled for that subnet. While it successfully creates an IP range and attaches the subnet to my-vpc, instances in that subnet would need external IP addresses or a Cloud NAT to reach Google APIs, which contradicts the requirement for private access. Therefore, the missing flag makes this option fail the full requirement.

• ✗

  gcloud compute firewall-rules create allow-http --allow tcp:80

  Why it's wrong here

  This command creates a firewall rule allowing TCP port 80 traffic, but it does not contribute to creating a VPC or a subnet, which is the stated goal. Firewall rules are network-level security controls applied after a network and subnets exist, so running this command alone would fail because the network my-vpc may not even exist yet, and it has no effect on subnet mode. It is irrelevant to the task.

• ✗

  gcloud compute networks create my-vpc --subnet-mode auto

  Why it's wrong here

  This command creates a VPC in auto subnet mode, where Google automatically creates subnets in every Google Cloud region using a predefined IP range. That is the opposite of custom mode, which starts with no subnets and lets the engineer define them manually, so this command would not satisfy the requirement for a custom subnet mode VPC. It could be corrected by changing --subnet-mode auto to --subnet-mode custom.

Go deeper

Related to this question