Google ACE Configuring Access and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an allow rule for tcp:80 with target tags 'web-server' and source range 0.0.0.0/0, and a deny rule for all other traffic.

  Why it's wrong here

  Adding an explicit deny rule for all other traffic is redundant because every VPC network has an implied deny-all ingress rule that blocks any traffic not matched by an allow rule. Creating a separate deny rule introduces an extra rule to manage, and if its priority is equal to or higher than the allow rule, it can inadvertently override the intended HTTP allow due to GCP's priority and deny-over-allow semantics.

• ✗

  Create an allow rule for tcp:80 with source range 0.0.0.0/0 and apply to all instances.

  Why it's wrong here

  Applying the TCP:80 allow rule to all instances would permit HTTP traffic from any source to every VM in the network, not just the intended web servers. This violates least privilege and broadens the attack surface unnecessarily. The correct approach is to target the rule only to instances bearing the 'web-server' target tag, so only those VMs accept inbound HTTP while all other instances remain protected by the implicit deny rule.

• ✗

  Create a deny rule for all ports except tcp:80 with target tags 'web-server'.

  Why it's wrong here

  A deny rule for 'all ports except tcp:80' is impossible to express cleanly because VPC firewall rules do not support an 'except' clause; you would need a separate deny rule for every other protocol and port, which is impractical and error-prone. Moreover, deny rules are evaluated before allow rules when priorities are equal, so a broad deny rule could block the intended HTTP traffic if it matches first. The implicit deny-all ingress rule already blocks all unwanted traffic, making an explicit deny both unnecessary and dangerous.

• ✓

  Create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. No deny rule is needed.

  Why this is correct

  This is correct because VPC networks include an implicit deny-all rule for inbound traffic, so the only rule needed is an explicit allow for HTTP traffic (TCP port 80) from all source IP addresses (0.0.0.0/0) to instances tagged with 'web-server'. Target tags let you apply the rule selectively, ensuring only web server VMs accept inbound HTTP while all other instances remain blocked by the implicit deny. No additional deny rule is required or advisable.

Go deeper

Related to this question