Google ACE Planning and Configuring a Cloud Solution Practice Question
An organization has a VPC with instances in two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They want to allow HTTP traffic from any instance in subnet-a to any instance in subnet-b. What firewall rule should be created?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An ingress rule on subnet-b allowing traffic from 10.0.1.0/24 on TCP port 80
Firewall rules are defined with direction and source/target. To allow inbound traffic to subnet-b from subnet-a, an ingress rule with source range 10.0.1.0/24 is needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An egress rule on subnet-b allowing traffic to 10.0.1.0/24 on TCP port 80
Why it's wrong here
An egress rule on subnet-b controls outbound traffic from instances in subnet-b. Since the HTTP request originates from an instance in subnet-a and is directed to an instance in subnet-b, an egress rule on the destination subnet does not govern the arrival of that request. The rule's direction and target subnet are both misaligned with the actual traffic flow, so it cannot enable the web server to receive the connection.
- ✗
An ingress rule on subnet-a allowing traffic to 10.0.2.0/24 on TCP port 80
Why it's wrong here
An ingress rule on subnet-a applies to traffic entering instances in subnet-a, meaning its destination must be within 10.0.1.0/24. This rule incorrectly specifies a destination of 10.0.2.0/24 (subnet-b), which is outside the scope of what an ingress rule on subnet-a can affect. Even if it did match, the destination instance is in subnet-b, so only an ingress rule attached to subnet-b can permit the inbound HTTP request.
- ✓
An ingress rule on subnet-b allowing traffic from 10.0.1.0/24 on TCP port 80
Why this is correct
This is correct because the HTTP request travels from an instance in subnet-a (source 10.0.1.0/24) to an instance in subnet-b (destination) on TCP port 80. An ingress rule on subnet-b with the source range set to 10.0.1.0/24 explicitly allows that inbound connection at the destination. In GCP, the destination subnet's ingress rules are the primary gate for allowing traffic to reach the target instance.
- ✗
An egress rule on subnet-a allowing traffic to 10.0.2.0/24 on TCP port 80
Why it's wrong here
An egress rule on subnet-a would govern outbound traffic leaving instances in subnet-a, and GCP's implicit default egress rule already permits all outbound traffic, so an explicit egress rule is generally unnecessary. More importantly, an egress rule on the source subnet cannot authorize the destination instance in subnet-b to accept the connection; the destination's ingress firewall is what must allow the traffic. Without an ingress rule on subnet-b, the HTTP request will be dropped regardless of the source subnet's egress configuration.
Visual reference
Go deeper
Related to this question
Learn chapter
Cloud Storage Classes and Lifecycle Rules
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.