Courseiva
← ACE
Full test
Question 104 of 1,000
Configuring Access and Security →easyMultiple ChoiceObjective-mapped

Google ACE Configuring Access and Security Practice Question

This ACE practice question tests your understanding of configuring access and security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

You need to allow inbound HTTP traffic to a set of Compute Engine instances that have the tag 'web-server'. All other inbound traffic should be denied. Which firewall rule configuration should you create?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. No deny rule is needed.

Firewall rules are stateful; you should create an allow rule for HTTP (tcp:80) with source range 0.0.0.0/0 and target tag 'web-server'. Implicit deny all inbound traffic is the default, so no explicit deny is needed.

Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Create an allow rule for tcp:80 with target tags 'web-server' and source range 0.0.0.0/0, and a deny rule for all other traffic.

    Why it's wrong here

    The deny rule is unnecessary because implicit deny already exists.

  • ✗

    Create an allow rule for tcp:80 with source range 0.0.0.0/0 and apply to all instances.

    Why it's wrong here

    This would allow HTTP to all instances, not just those with the 'web-server' tag.

  • ✗

    Create a deny rule for all ports except tcp:80 with target tags 'web-server'.

    Why it's wrong here

    This would deny all ports except 80, but the default deny already blocks other traffic. Also, deny rules are evaluated before allow rules, so this could cause issues.

  • ✓

    Create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. No deny rule is needed.

    Why this is correct

    Correct. Default deny all inbound traffic applies; only allow HTTP to tagged instances.

    Related concept

    Standard ACLs match source addresses.

Common exam traps

Common exam trap: ACLs stop at the first match

ACLs are processed top to bottom. The first matching entry wins, and an implicit deny usually exists at the end.

Detailed technical explanation

How to think about this question

ACL questions test precision: source, destination, protocol, port and direction. A generally correct ACL can still fail if it is applied on the wrong interface or in the wrong direction.

KKey Concepts to Remember

  • Standard ACLs match source addresses.
  • Extended ACLs can match source, destination, protocol and ports.
  • The first matching ACL entry is used.
  • There is usually an implicit deny at the end.

TExam Day Tips

  • Check inbound versus outbound direction.
  • Read the ACL from top to bottom.
  • Look for a broader permit or deny above the intended line.

Key takeaway

ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.

Real-world example

How this comes up in practice

An e-commerce site experiences heavy traffic on Black Friday and near-zero traffic during off-peak weeks. Rather than provisioning permanent large VMs, the team uses auto-scaling groups that add capacity automatically under load and reduce it overnight. Questions like this test whether you understand elasticity, availability zones, and cloud compute scaling patterns.

What to study next

Got this wrong? Here's your next step.

Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related ACE ACL questions on filtering logic and placement.

Related practice questions

Related ACE practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Configuring Access and Security practice questions

Practise ACE questions linked to Configuring Access and Security.

Planning and Configuring a Cloud Solution practice questions

Practise ACE questions linked to Planning and Configuring a Cloud Solution.

Ensuring Successful Operation of a Cloud Solution practice questions

Practise ACE questions linked to Ensuring Successful Operation of a Cloud Solution.

Deploying and Implementing a Cloud Solution practice questions

Practise ACE questions linked to Deploying and Implementing a Cloud Solution.

Setting Up a Cloud Solution Environment practice questions

Practise ACE questions linked to Setting Up a Cloud Solution Environment.

ACE fundamentals practice questions

Practise ACE questions linked to ACE fundamentals.

ACE scenario practice questions

Practise ACE questions linked to ACE scenario.

ACE troubleshooting practice questions

Practise ACE questions linked to ACE troubleshooting.

Practice this exam

Start a free ACE practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions20 questions30 questions50 questionsTimed 30
ACE practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this ACE question test?

Configuring Access and Security — This question tests Configuring Access and Security — Standard ACLs match source addresses..

What is the correct answer to this question?

The correct answer is: Create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. No deny rule is needed. — Firewall rules are stateful; you should create an allow rule for HTTP (tcp:80) with source range 0.0.0.0/0 and target tag 'web-server'. Implicit deny all inbound traffic is the default, so no explicit deny is needed.

What should I do if I get this ACE question wrong?

Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related ACE ACL questions on filtering logic and placement.

What is the key concept behind this question?

Standard ACLs match source addresses.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Last reviewed: Jul 4, 2026

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

Sign in to join the discussion.

This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.