Google ACE Practice Question: Based on the exhibit, which type of traffic will…

Exhibit

Refer to the exhibit.

$ gcloud compute instances describe my-vm --zone=us-central1-a
...
networkInterfaces:
- network: https://www.googleapis.com/compute/v1/projects/my-project/global/networks/default
  subnetwork: https://www.googleapis.com/compute/v1/projects/my-project/regions/us-central1/subnetworks/default
  accessConfigs:
  - name: external-nat
    type: ONE_TO_ONE_NAT
    natIP: 34.71.192.55
tags:
  items:
  - web-server
serviceAccounts:
- email: 123456789-compute@developer.gserviceaccount.com
  scopes:
  - https://www.googleapis.com/auth/cloud-platform

Firewall rules:
- name: allow-http-from-internet
  direction: INGRESS
  priority: 1000
  sourceRanges:
  - 0.0.0.0/0
  allowed:
  - IPProtocol: tcp
    ports:
    - '80'
  targetTags:
  - web-server
- name: deny-all-ingress
  direction: INGRESS
  priority: 2000
  sourceRanges:
  - 0.0.0.0/0
  denied:
  - IPProtocol: all

Based on the exhibit, which type of traffic will successfully reach the instance?

⚠ Common exam trap

Google Cloud often tests the misconception that the implicit deny-all rule blocks all traffic indiscriminately, but candidates must remember that explicit allow rules take precedence and permit matching traffic before the deny rule is evaluated.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

HTTP traffic from the internet (port 80)

The exhibit shows a firewall rule allowing inbound HTTP traffic (port 80) from 0.0.0.0/0, which permits any source on the internet to reach the instance on that port. Firewall rules in Google Cloud are stateful, so the corresponding outbound return traffic is automatically allowed. No other rule permits HTTPS or all traffic, and the implicit deny-all rule blocks anything not explicitly allowed.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
HTTPS traffic (port 443) from the internet
Why it's wrong here
HTTPS uses TCP port 443, which is not covered by the only custom ingress allow rule (TCP:80, source 0.0.0.0/0, priority 1000). Because firewall rules are evaluated by ascending priority and only the first matching rule is applied, no allow rule matches this packet, so evaluation reaches the priority-2000 deny-all ingress rule and the connection is dropped. Therefore HTTPS from the internet cannot succeed.
✗
All inbound traffic
Why it's wrong here
All inbound traffic would require the firewall to permit every protocol and port from the internet, but the custom allow rule only permits HTTP on TCP port 80. Any other inbound traffic—such as SSH, RDP, ICMP, DNS, or non-HTTP application traffic—fails to match that allow rule and is consequently denied by the deny-all ingress rule at priority 2000. Since a deny-all rule explicitly exists and has no allow override except for HTTP, only HTTP traffic succeeds, not all inbound traffic.
✓
HTTP traffic from the internet (port 80)
Why this is correct
Inbound HTTP packets have destination TCP port 80 and source IPs in 0.0.0.0/0, which exactly matches the custom ingress allow rule (protocol tcp, ports 80, priority 1000, applied to the instance's network tag). Because priority 1000 is lower than the deny-all rule's 2000, the allow rule is evaluated first and matches, so HTTP is permitted before the deny rule is ever considered. GCP firewall rules are stateful as well, so the return traffic for these HTTP connections is automatically allowed, making HTTP traffic from the internet successful.
✗
No traffic; the deny-all rule takes effect
Why it's wrong here
The allow rule has lower priority number (1000) so it is evaluated first and allows HTTP; the deny-all rule (2000) is only evaluated if no allow rule matches, but since HTTP matches, it is allowed.

Visual reference

Go deeper

Google ACE Practice Question: Based on the exhibit, which type of traffic will…

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question